# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Jan 31 2020 07:36:36 # Log Creation Date: 31.01.2020 07:39:57.681 Process: id = "1" image_name = "inbox.pe.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe" page_root = "0x33c66000" os_pid = "0x8dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x8cc [0025.966] GetModuleHandleA (lpModuleName=0x0) returned 0x20000000 [0025.967] GetKeyboardType (nTypeFlag=0) returned 4 [0025.967] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe\" " [0025.967] GetStartupInfoA (in: lpStartupInfo=0x18fec8 | out: lpStartupInfo=0x18fec8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0025.967] GetVersion () returned 0x1db10106 [0025.967] GetVersion () returned 0x1db10106 [0025.967] GetCurrentThreadId () returned 0x8cc [0025.967] SetSystemTime (lpSystemTime=0x2000dc8c*(wYear=0x7e5, wMonth=0x9, wDayOfWeek=0x0, wDay=0x5, wHour=0x2, wMinute=0x1, wSecond=0x1, wMilliseconds=0x1)) returned 1 [0026.023] Sleep (dwMilliseconds=0xa) [0026.045] GetLocalTime (in: lpSystemTime=0x18ff2c | out: lpSystemTime=0x18ff2c*(wYear=0x7e5, wMonth=0x9, wDayOfWeek=0x0, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x4f)) [0026.045] SetLocalTime (lpSystemTime=0x18ff2c*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x0, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x4f)) returned 1 [0026.055] GetLocalTime (in: lpSystemTime=0x18febc | out: lpSystemTime=0x18febc*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x4f)) [0026.055] SetLocalTime (lpSystemTime=0x18febc*(wYear=0x7e3, wMonth=0x9, wDayOfWeek=0x6, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x4f)) returned 1 [0026.066] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x2553e8 [0026.066] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x3b0000 [0026.066] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x2563e8 [0026.067] VirtualAlloc (lpAddress=0x3b0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b0000 [0026.067] LoadLibraryA (lpLibFileName="Kernel32") returned 0x76e10000 [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileA") returned 0x76e253c6 [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointer") returned 0x76e217d1 [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSize") returned 0x76e2196e [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="ResumeThread") returned 0x76e243ef [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadContext") returned 0x76ea5393 [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="ReadProcessMemory") returned 0x76e3cfcc [0026.067] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadContext") returned 0x76e479d4 [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessA") returned 0x76e21072 [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceA") returned 0x76e3e9bb [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="FreeResource") returned 0x76e3d3db [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="WriteProcessMemory") returned 0x76e3d9e0 [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualAllocEx") returned 0x76e3d9b0 [0026.068] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0026.068] FreeLibrary (hLibModule=0x76e10000) returned 1 [0026.068] GetLocalTime (in: lpSystemTime=0x18febc | out: lpSystemTime=0x18febc*(wYear=0x7e3, wMonth=0x9, wDayOfWeek=0x4, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x5e)) [0026.068] SetLocalTime (lpSystemTime=0x18febc*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x4, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x5e)) returned 1 [0026.084] VirtualFree (lpAddress=0x3b0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.084] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0026.085] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x20009964, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe")) returned 0x32 [0026.085] FindResourceA (hModule=0x20000000, lpName="STR", lpType=0xa) returned 0x200121a0 [0026.085] SizeofResource (hModule=0x20000000, hResInfo=0x200121a0) returned 0x4200 [0026.085] LoadResource (hModule=0x20000000, hResInfo=0x200121a0) returned 0x20022988 [0026.085] LockResource (hResData=0x20022988) returned 0x20022988 [0026.085] FreeResource (hResData=0x20022988) returned 0 [0026.085] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x3b0000 [0026.085] VirtualAlloc (lpAddress=0x3b0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b0000 [0026.086] FindResourceA (hModule=0x20000000, lpName="l2K", lpType=0xa) returned 0x20012180 [0026.086] SizeofResource (hModule=0x20000000, hResInfo=0x20012180) returned 0xfa16 [0026.086] LoadResource (hModule=0x20000000, hResInfo=0x20012180) returned 0x20012ed0 [0026.086] LockResource (hResData=0x20012ed0) returned 0x20012ed0 [0026.086] FreeResource (hResData=0x20012ed0) returned 0 [0026.086] VirtualAlloc (lpAddress=0x3b4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b4000 [0026.087] VirtualAlloc (lpAddress=0x3c4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3c4000 [0026.087] VirtualFree (lpAddress=0x3c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.088] VirtualFree (lpAddress=0x3b4000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0026.088] VirtualAlloc (lpAddress=0x3b4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b4000 [0026.090] VirtualAlloc (lpAddress=0x3d4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d4000 [0026.090] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.091] VirtualAlloc (lpAddress=0x3dc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3dc000 [0026.092] VirtualAlloc (lpAddress=0x3e0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e0000 [0026.092] VirtualAlloc (lpAddress=0x3e4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e4000 [0026.094] VirtualAlloc (lpAddress=0x3e8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e8000 [0026.096] VirtualAlloc (lpAddress=0x3ec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3ec000 [0026.097] VirtualAlloc (lpAddress=0x3f0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3f0000 [0026.097] VirtualAlloc (lpAddress=0x3f4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3f4000 [0026.098] VirtualAlloc (lpAddress=0x3f8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3f8000 [0026.098] VirtualFree (lpAddress=0x3c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.098] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.098] VirtualFree (lpAddress=0x3d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.099] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.099] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.099] VirtualFree (lpAddress=0x3e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.099] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.099] VirtualFree (lpAddress=0x3e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.099] VirtualFree (lpAddress=0x3b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.099] VirtualFree (lpAddress=0x3c4000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0026.100] VirtualAlloc (lpAddress=0x3b4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b4000 [0026.101] VirtualAlloc (lpAddress=0x3c4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3c4000 [0026.101] VirtualFree (lpAddress=0x3c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.110] RtlDecompressBuffer (in: CompressionFormat=0x102, UncompressedBuffer=0x3c400c, UncompressedBufferSize=0xc333, CompressedBuffer=0x3b0070, CompressedBufferSize=0xc0b7, FinalUncompressedSize=0x18ff2c | out: UncompressedBuffer=0x3c400c, FinalUncompressedSize=0x18ff2c) returned 0x0 [0026.112] VirtualFree (lpAddress=0x3b4000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0026.114] VirtualAlloc (lpAddress=0x3d4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d4000 [0026.115] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.116] VirtualFree (lpAddress=0x3d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.116] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.118] VirtualAlloc (lpAddress=0x3b4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b4000 [0026.118] VirtualFree (lpAddress=0x3b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.118] VirtualAlloc (lpAddress=0x3b4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b4000 [0026.118] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.119] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.119] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.119] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.119] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.119] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.119] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.120] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.120] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.120] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.120] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.120] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.121] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.121] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.121] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.121] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.121] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.122] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.122] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.123] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.123] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.123] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.123] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.124] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.124] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.124] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.124] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.124] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.125] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.125] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.125] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.125] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.125] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.125] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.126] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.126] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.126] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.126] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.126] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.127] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.127] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.127] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.127] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.127] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.128] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.128] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.128] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.128] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.128] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.128] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.129] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.129] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.129] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.129] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.129] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.130] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.130] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.130] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.130] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.130] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.130] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.131] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.131] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.131] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.131] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.131] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.132] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.132] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.132] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.132] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.132] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.133] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.133] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.133] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.133] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.133] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.134] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.134] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.134] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.134] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.134] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.134] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.135] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.135] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.135] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.135] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.135] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.136] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.136] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.136] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.136] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.136] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.137] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.137] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.137] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.137] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.137] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.138] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.138] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.138] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.138] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.139] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.139] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.139] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.139] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.139] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.140] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.140] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.140] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.140] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.140] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.140] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.141] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.141] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.141] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.141] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.141] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.142] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.142] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.142] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.142] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.142] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.143] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.143] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.143] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.143] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.143] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.144] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.144] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.144] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.144] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.144] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.144] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.145] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.145] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.145] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.145] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.145] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.146] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.146] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.146] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.146] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.146] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.147] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.147] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.147] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.147] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.147] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.148] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.148] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.148] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.148] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.148] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.148] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.149] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.149] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.149] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.149] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.149] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.150] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.150] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.150] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.150] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.150] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.151] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.151] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.151] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.151] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.151] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.151] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.152] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.152] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.152] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.152] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.152] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.153] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.153] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.153] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.153] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.153] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.154] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.154] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.154] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.154] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.154] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.155] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.155] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.155] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.155] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.155] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.156] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.156] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.156] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.156] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.156] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.156] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.157] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.157] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.157] VirtualAlloc (lpAddress=0x3b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b8000 [0026.157] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.157] VirtualAlloc (lpAddress=0x3bc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bc000 [0026.158] VirtualFree (lpAddress=0x3b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.158] VirtualFree (lpAddress=0x3c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.158] VirtualAlloc (lpAddress=0x3d4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d4000 [0026.158] VirtualFree (lpAddress=0x3b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.159] VirtualFree (lpAddress=0x3bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.159] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.159] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.159] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.159] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.159] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.160] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.160] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.160] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.160] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.160] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.161] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.161] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.161] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.161] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.162] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.162] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.162] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.162] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.162] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.163] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.163] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.163] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.163] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.164] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.164] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.164] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.164] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.164] VirtualAlloc (lpAddress=0x3dc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3dc000 [0026.165] VirtualFree (lpAddress=0x3d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.165] VirtualFree (lpAddress=0x3e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.165] VirtualAlloc (lpAddress=0x3e0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e0000 [0026.165] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.166] VirtualFree (lpAddress=0x3e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.166] VirtualAlloc (lpAddress=0x3d4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d4000 [0026.166] VirtualFree (lpAddress=0x3e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.166] VirtualFree (lpAddress=0x3d8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0026.166] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.167] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.167] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.167] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.167] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.167] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.168] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.168] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.168] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.168] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.168] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.169] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.169] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.169] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.169] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.170] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.170] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.170] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.170] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.170] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.171] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.171] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.171] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.171] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.171] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.172] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.172] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.172] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.172] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.172] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.172] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.173] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.173] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.173] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.173] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.173] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.174] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.174] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.174] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.174] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.174] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.175] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.175] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.175] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.175] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.175] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.176] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.176] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.176] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.176] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.176] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.176] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.177] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.177] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.177] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.177] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.177] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.178] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.178] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.178] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.178] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.178] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.179] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.179] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.179] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.179] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.179] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.179] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.180] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.180] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.180] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.180] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.180] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.181] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.181] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.181] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.181] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.181] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.182] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.182] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.182] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.182] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.182] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.183] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.183] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.183] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.183] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.183] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.184] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.184] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.184] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.184] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.184] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.185] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.185] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.185] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.185] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.186] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.186] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.186] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.186] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.186] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.186] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.187] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.187] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.187] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.187] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.187] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.188] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.188] VirtualFree (lpAddress=0x3dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.188] VirtualFree (lpAddress=0x3d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0026.188] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.190] VirtualAlloc (lpAddress=0x3dc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3dc000 [0026.190] VirtualAlloc (lpAddress=0x3e0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e0000 [0026.191] VirtualAlloc (lpAddress=0x3d4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d4000 [0026.191] VirtualAlloc (lpAddress=0x3d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d8000 [0026.529] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x232)) [0026.529] SetLocalTime (lpSystemTime=0x18fcb4*(wYear=0x7e5, wMonth=0x9, wDayOfWeek=0x6, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x232)) returned 1 [0026.560] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18fdbb, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe")) returned 0x32 [0026.560] VirtualAlloc (lpAddress=0x40c000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x40c000 [0026.573] GetThreadContext (in: hThread=0x94, lpContext=0x18fcec | out: lpContext=0x18fcec*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x20006d60, Ebp=0x0, Eip=0x773301c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0xf0, [1]=0xfd, [2]=0x18, [3]=0x43, [4]=0x3a, [5]=0x5c, [6]=0x55, [7]=0x73, [8]=0x65, [9]=0x72, [10]=0x73, [11]=0x5c, [12]=0x35, [13]=0x70, [14]=0x35, [15]=0x4e, [16]=0x72, [17]=0x47, [18]=0x4a, [19]=0x6e, [20]=0x30, [21]=0x6a, [22]=0x53, [23]=0x20, [24]=0x48, [25]=0x41, [26]=0x4c, [27]=0x50, [28]=0x6d, [29]=0x63, [30]=0x78, [31]=0x7a, [32]=0x5c, [33]=0x44, [34]=0x65, [35]=0x73, [36]=0x6b, [37]=0x74, [38]=0x6f, [39]=0x70, [40]=0x5c, [41]=0x69, [42]=0x6e, [43]=0x62, [44]=0x6f, [45]=0x78, [46]=0x2e, [47]=0x70, [48]=0x65, [49]=0x2e, [50]=0x65, [51]=0x78, [52]=0x65, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x20, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x90, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x94, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x80, [341]=0x9, [342]=0x0, [343]=0x0, [344]=0x70, [345]=0x7, [346]=0x0, [347]=0x0, [348]=0x4, [349]=0xe0, [350]=0x42, [351]=0x0, [352]=0x0, [353]=0x20, [354]=0x2, [355]=0x0, [356]=0xac, [357]=0x80, [358]=0x3f, [359]=0x0, [360]=0x84, [361]=0xdc, [362]=0x0, [363]=0x20, [364]=0x5c, [365]=0x2, [366]=0x3b, [367]=0x0, [368]=0x4, [369]=0xc0, [370]=0x40, [371]=0x0, [372]=0x64, [373]=0x1, [374]=0x3b, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x64, [381]=0x0, [382]=0x3b, [383]=0x0, [384]=0x88, [385]=0xff, [386]=0x18, [387]=0x0, [388]=0x7e, [389]=0x70, [390]=0x0, [391]=0x20, [392]=0x7c, [393]=0xff, [394]=0x18, [395]=0x0, [396]=0x97, [397]=0x72, [398]=0x0, [399]=0x20, [400]=0x88, [401]=0xff, [402]=0x18, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0xe0, [414]=0xfd, [415]=0x7e, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0xc, [429]=0x40, [430]=0x3c, [431]=0x0, [432]=0x4c, [433]=0x3, [434]=0x3d, [435]=0x0, [436]=0xec, [437]=0xbf, [438]=0x3e, [439]=0x0, [440]=0x24, [441]=0x0, [442]=0x3b, [443]=0x0, [444]=0x23, [445]=0x9b, [446]=0x0, [447]=0x20, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0xc4, [453]=0xff, [454]=0x18, [455]=0x0, [456]=0x28, [457]=0x37, [458]=0x0, [459]=0x20, [460]=0x88, [461]=0xff, [462]=0x18, [463]=0x0, [464]=0x94, [465]=0xff, [466]=0x18, [467]=0x0, [468]=0xca, [469]=0x33, [470]=0xe2, [471]=0x76, [472]=0x0, [473]=0xe0, [474]=0xfd, [475]=0x7e, [476]=0xd4, [477]=0xff, [478]=0x18, [479]=0x0, [480]=0xd2, [481]=0x9e, [482]=0x35, [483]=0x77, [484]=0x0, [485]=0xe0, [486]=0xfd, [487]=0x7e, [488]=0x16, [489]=0xa7, [490]=0x58, [491]=0x77, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0xe0, [502]=0xfd, [503]=0x7e, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0026.577] ReadProcessMemory (in: hProcess=0x90, lpBaseAddress=0x7efde008, lpBuffer=0x18ff20, nSize=0x4, lpNumberOfBytesRead=0x18ff1c | out: lpBuffer=0x18ff20*, lpNumberOfBytesRead=0x18ff1c*=0x4) returned 1 [0026.578] VirtualAllocEx (hProcess=0x90, lpAddress=0x400000, dwSize=0x22000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0026.578] WriteProcessMemory (in: hProcess=0x90, lpBaseAddress=0x400000, lpBuffer=0x40c004*, nSize=0x22000, lpNumberOfBytesWritten=0x18ff1c | out: lpBuffer=0x40c004*, lpNumberOfBytesWritten=0x18ff1c*=0x22000) returned 1 [0026.584] WriteProcessMemory (in: hProcess=0x90, lpBaseAddress=0x7efde008, lpBuffer=0x3b0198*, nSize=0x4, lpNumberOfBytesWritten=0x18ff1c | out: lpBuffer=0x3b0198*, lpNumberOfBytesWritten=0x18ff1c*=0x4) returned 1 [0026.592] SetThreadContext (hThread=0x94, lpContext=0x18fcec*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x4205b0, Ebp=0x0, Eip=0x773301c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0xf0, [1]=0xfd, [2]=0x18, [3]=0x43, [4]=0x3a, [5]=0x5c, [6]=0x55, [7]=0x73, [8]=0x65, [9]=0x72, [10]=0x73, [11]=0x5c, [12]=0x35, [13]=0x70, [14]=0x35, [15]=0x4e, [16]=0x72, [17]=0x47, [18]=0x4a, [19]=0x6e, [20]=0x30, [21]=0x6a, [22]=0x53, [23]=0x20, [24]=0x48, [25]=0x41, [26]=0x4c, [27]=0x50, [28]=0x6d, [29]=0x63, [30]=0x78, [31]=0x7a, [32]=0x5c, [33]=0x44, [34]=0x65, [35]=0x73, [36]=0x6b, [37]=0x74, [38]=0x6f, [39]=0x70, [40]=0x5c, [41]=0x69, [42]=0x6e, [43]=0x62, [44]=0x6f, [45]=0x78, [46]=0x2e, [47]=0x70, [48]=0x65, [49]=0x2e, [50]=0x65, [51]=0x78, [52]=0x65, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x20, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x90, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x94, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x80, [341]=0x9, [342]=0x0, [343]=0x0, [344]=0x70, [345]=0x7, [346]=0x0, [347]=0x0, [348]=0x4, [349]=0xe0, [350]=0x42, [351]=0x0, [352]=0x0, [353]=0x20, [354]=0x2, [355]=0x0, [356]=0x4, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x20, [364]=0x5c, [365]=0x2, [366]=0x3b, [367]=0x0, [368]=0x4, [369]=0xc0, [370]=0x40, [371]=0x0, [372]=0x64, [373]=0x1, [374]=0x3b, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x64, [381]=0x0, [382]=0x3b, [383]=0x0, [384]=0x88, [385]=0xff, [386]=0x18, [387]=0x0, [388]=0x7e, [389]=0x70, [390]=0x0, [391]=0x20, [392]=0x7c, [393]=0xff, [394]=0x18, [395]=0x0, [396]=0x97, [397]=0x72, [398]=0x0, [399]=0x20, [400]=0x88, [401]=0xff, [402]=0x18, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0xe0, [414]=0xfd, [415]=0x7e, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0xc, [429]=0x40, [430]=0x3c, [431]=0x0, [432]=0x4c, [433]=0x3, [434]=0x3d, [435]=0x0, [436]=0xec, [437]=0xbf, [438]=0x3e, [439]=0x0, [440]=0x24, [441]=0x0, [442]=0x3b, [443]=0x0, [444]=0x23, [445]=0x9b, [446]=0x0, [447]=0x20, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0xc4, [453]=0xff, [454]=0x18, [455]=0x0, [456]=0x28, [457]=0x37, [458]=0x0, [459]=0x20, [460]=0x88, [461]=0xff, [462]=0x18, [463]=0x0, [464]=0x94, [465]=0xff, [466]=0x18, [467]=0x0, [468]=0xca, [469]=0x33, [470]=0xe2, [471]=0x76, [472]=0x0, [473]=0xe0, [474]=0xfd, [475]=0x7e, [476]=0xd4, [477]=0xff, [478]=0x18, [479]=0x0, [480]=0xd2, [481]=0x9e, [482]=0x35, [483]=0x77, [484]=0x0, [485]=0xe0, [486]=0xfd, [487]=0x7e, [488]=0x16, [489]=0xa7, [490]=0x58, [491]=0x77, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0xe0, [502]=0xfd, [503]=0x7e, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0026.593] ResumeThread (hThread=0x94) returned 0x1 [0026.627] GetLocalTime (in: lpSystemTime=0x18fcb0 | out: lpSystemTime=0x18fcb0*(wYear=0x7e5, wMonth=0x9, wDayOfWeek=0x0, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x28f)) [0026.627] SetLocalTime (lpSystemTime=0x18fcb0*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x0, wDay=0x5, wHour=0xc, wMinute=0x1, wSecond=0x1, wMilliseconds=0x28f)) returned 1 [0026.724] LocalFree (hMem=0x2553e8) returned 0x0 [0026.724] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0026.725] LocalFree (hMem=0x2563e8) returned 0x0 [0026.725] ExitProcess (uExitCode=0x0) Process: id = "2" image_name = "inbox.pe.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe" page_root = "0x318cd000" os_pid = "0x980" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x8dc" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2 os_tid = 0x770 [0026.741] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="WritePrivateProfileStringA") returned 0x76e47048 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointer") returned 0x76e217d1 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileA") returned 0x76e9d911 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryA") returned 0x76e249d7 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersionExA") returned 0x76e23519 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemInfo") returned 0x76e249ca [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetPrivateProfileIntA") returned 0x76e4cdd7 [0026.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSize") returned 0x76e2196e [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesA") returned 0x76e25414 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="FreeResource") returned 0x76e3d3db [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageA") returned 0x76e45fbd [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceA") returned 0x76e3e9bb [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileA") returned 0x76e2e2ce [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileA") returned 0x76e25444 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileA") returned 0x76e253c6 [0026.743] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0026.744] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0026.744] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSection") returned 0x77352c42 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualFree") returned 0x76e2186e [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualAlloc") returned 0x76e21856 [0026.744] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualQuery") returned 0x76e2445a [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenA") returned 0x76e25a4b [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcpyA") returned 0x76e42a9d [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExA") returned 0x76e24913 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadLocale") returned 0x76e235cf [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoA") returned 0x76e20e00 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoA") returned 0x76e3d5e5 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0026.745] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointer") returned 0x76e217d1 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSize") returned 0x76e2196e [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileA") returned 0x76e253c6 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0026.746] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0026.746] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameExA") returned 0x76ea42ef [0026.747] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x754b0000 [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExA") returned 0x754c14b3 [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExA") returned 0x754c48ef [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExA") returned 0x754c4907 [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyExA") returned 0x754c1469 [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="GetUserNameA") returned 0x754da4b4 [0026.747] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x754b0000 [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExA") returned 0x754c48ef [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExA") returned 0x754c4907 [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0026.747] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x754b0000 [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="CryptDestroyKey") returned 0x754bc51a [0026.747] GetProcAddress (hModule=0x754b0000, lpProcName="CryptDestroyHash") returned 0x754bdf66 [0026.748] GetProcAddress (hModule=0x754b0000, lpProcName="CryptReleaseContext") returned 0x754be124 [0026.748] GetProcAddress (hModule=0x754b0000, lpProcName="CryptHashData") returned 0x754bdf36 [0026.748] GetProcAddress (hModule=0x754b0000, lpProcName="CryptCreateHash") returned 0x754bdf4e [0026.748] GetProcAddress (hModule=0x754b0000, lpProcName="CryptEncrypt") returned 0x754d779b [0026.748] GetProcAddress (hModule=0x754b0000, lpProcName="CryptDeriveKey") returned 0x754f3188 [0026.748] GetProcAddress (hModule=0x754b0000, lpProcName="CryptAcquireContextA") returned 0x754b91dd [0026.748] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74500000 [0026.748] GetProcAddress (hModule=0x74500000, lpProcName="InitCommonControls") returned 0x74501739 [0026.748] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x752d0000 [0026.748] GetProcAddress (hModule=0x752d0000, lpProcName="StretchDIBits") returned 0x752e7435 [0026.748] GetProcAddress (hModule=0x752d0000, lpProcName="SetWindowOrgEx") returned 0x752eaf0a [0026.748] GetProcAddress (hModule=0x752d0000, lpProcName="SetTextColor") returned 0x752e522d [0026.748] GetProcAddress (hModule=0x752d0000, lpProcName="SetROP2") returned 0x752ebc54 [0026.748] GetProcAddress (hModule=0x752d0000, lpProcName="SetBrushOrgEx") returned 0x752e9541 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="SetBkMode") returned 0x752e51a2 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="SetBkColor") returned 0x752e52d8 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="SelectObject") returned 0x752e4f70 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="SelectClipRgn") returned 0x752e8916 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="SaveDC") returned 0x752e6e05 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="RestoreDC") returned 0x752e6ead [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="MoveToEx") returned 0x752e8ee6 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="IntersectClipRect") returned 0x752e7dc4 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="GetWindowOrgEx") returned 0x752ee310 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="GetStockObject") returned 0x752e4eb8 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="GetObjectA") returned 0x752e85d4 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="ExcludeClipRect") returned 0x752ea066 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="DeleteObject") returned 0x752e5689 [0026.749] GetProcAddress (hModule=0x752d0000, lpProcName="DeleteDC") returned 0x752e58b3 [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="CreateSolidBrush") returned 0x752e4f17 [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="CreateRectRgnIndirect") returned 0x752ea764 [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="CreateRectRgn") returned 0x752e77cf [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="CreateFontIndirectA") returned 0x752ecffd [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="CreateDIBSection") returned 0x752eac46 [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="CreateCompatibleDC") returned 0x752e54f4 [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="CreateCompatibleBitmap") returned 0x752e5f49 [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="CombineRgn") returned 0x752ea903 [0026.750] GetProcAddress (hModule=0x752d0000, lpProcName="BitBlt") returned 0x752e5ea6 [0026.750] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x769d0000 [0026.750] GetProcAddress (hModule=0x769d0000, lpProcName="VariantCopyInd") returned 0x769ee86c [0026.750] GetProcAddress (hModule=0x769d0000, lpProcName="VariantClear") returned 0x769d3eae [0026.750] GetProcAddress (hModule=0x769d0000, lpProcName="SysFreeString") returned 0x769d3e59 [0026.750] GetProcAddress (hModule=0x769d0000, lpProcName="SysReAllocStringLen") returned 0x769d7810 [0026.750] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75670000 [0026.751] GetProcAddress (hModule=0x75670000, lpProcName="SHFileOperationA") returned 0x758caddd [0026.751] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76780000 [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="WaitMessage") returned 0x767bf5a9 [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="ValidateRect") returned 0x767a7849 [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="UpdateWindow") returned 0x767a3559 [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="TranslateMessage") returned 0x76797809 [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="ShowWindow") returned 0x767a0dfb [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextA") returned 0x767a7aee [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowPos") returned 0x76798e4e [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowLongA") returned 0x767a6110 [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="SetTimer") returned 0x767979fb [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="SetPropA") returned 0x767a822c [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="SetFocus") returned 0x767a2175 [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0026.751] GetProcAddress (hModule=0x76780000, lpProcName="SetCapture") returned 0x767bed56 [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageA") returned 0x767a612e [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="ScreenToClient") returned 0x767a227d [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="RemovePropA") returned 0x767a8284 [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="ReleaseDC") returned 0x76797446 [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="ReleaseCapture") returned 0x767bed49 [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="RegisterWindowMessageA") returned 0x767a0afa [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="RegisterClassA") returned 0x767a434b [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="PostQuitMessage") returned 0x76799abb [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="PostMessageA") returned 0x767a3baa [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="PeekMessageA") returned 0x767a5f74 [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="OffsetRect") returned 0x767a0bbd [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="MoveWindow") returned 0x767a3698 [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="MessageBoxA") returned 0x767efd1e [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="LoadIconA") returned 0x7679dafb [0026.752] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorA") returned 0x7679dad5 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="KillTimer") returned 0x767979db [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="IsZoomed") returned 0x767a3332 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="IsWindowVisible") returned 0x767a112d [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="IsWindowEnabled") returned 0x767a2c1b [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="IsWindow") returned 0x76797136 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="IsIconic") returned 0x767a32a9 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="InvalidateRgn") returned 0x767a6604 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="InvalidateRect") returned 0x767a1381 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="GetWindowTextLengthA") returned 0x767ab29a [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="GetWindowTextA") returned 0x767a0029 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="GetWindowRect") returned 0x76797f34 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="GetWindowLongA") returned 0x7679d156 [0026.753] GetProcAddress (hModule=0x76780000, lpProcName="GetWindowDC") returned 0x76798048 [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetUpdateRgn") returned 0x767a6222 [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetUpdateRect") returned 0x767bd41f [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetSystemMenu") returned 0x767a6ea6 [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColor") returned 0x76796c3c [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetPropA") returned 0x767a7b5a [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetParent") returned 0x767a0f68 [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetWindow") returned 0x7679926e [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetKeyState") returned 0x767a291f [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetFocus") returned 0x767a0dee [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetDC") returned 0x767972c4 [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetCursorPos") returned 0x767a1218 [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetClientRect") returned 0x767a0c62 [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetClassLongA") returned 0x767a86f9 [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetClassInfoA") returned 0x767a6ade [0026.754] GetProcAddress (hModule=0x76780000, lpProcName="GetCapture") returned 0x767a2aac [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="GetAsyncKeyState") returned 0x767beb96 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="FillRect") returned 0x767a0eb6 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="EndPaint") returned 0x767a1341 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="EnableWindow") returned 0x767a2da4 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="EnableMenuItem") returned 0x767a6f50 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="DispatchMessageA") returned 0x76797bbb [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="DestroyWindow") returned 0x76799a55 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="DestroyIcon") returned 0x767a49b2 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="DestroyAcceleratorTable") returned 0x767a3db6 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="DeleteMenu") returned 0x767a6d2a [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="DefWindowProcA") returned 0x773624e0 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="CreateWindowExA") returned 0x7679d22e [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="CopyImage") returned 0x767a4a09 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="ClientToScreen") returned 0x767a2606 [0026.755] GetProcAddress (hModule=0x76780000, lpProcName="CallWindowProcA") returned 0x767a792f [0026.756] GetProcAddress (hModule=0x76780000, lpProcName="BeginPaint") returned 0x767a1361 [0026.756] GetProcAddress (hModule=0x76780000, lpProcName="CharLowerA") returned 0x767a3e75 [0026.756] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76780000 [0026.756] GetProcAddress (hModule=0x76780000, lpProcName="GetKeyboardType") returned 0x767d9ac4 [0026.756] GetProcAddress (hModule=0x76780000, lpProcName="MessageBoxA") returned 0x767efd1e [0026.758] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0026.758] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fe5c, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe")) returned 0x32 [0026.761] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18fd37, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe")) returned 0x32 [0026.761] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18fe4c | out: phkResult=0x18fe4c*=0x0) returned 0x2 [0026.761] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18fe4c | out: phkResult=0x18fe4c*=0x0) returned 0x2 [0026.761] lstrcpyA (in: lpString1=0x18fd37, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" [0026.761] GetThreadLocale () returned 0x409 [0026.761] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18fe47, cchData=5 | out: lpLCData="ENU") returned 4 [0026.770] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe") returned 50 [0026.770] lstrcpyA (in: lpString1=0x18fd66, lpString2="ENU" | out: lpString1="ENU") returned="ENU" [0026.770] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0026.770] lstrcpyA (in: lpString1=0x18fd66, lpString2="EN" | out: lpString1="EN") returned="EN" [0026.770] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0026.773] GetKeyboardType (nTypeFlag=0) returned 4 [0026.773] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe\"" [0026.773] GetStartupInfoA (in: lpStartupInfo=0x18fef0 | out: lpStartupInfo=0x18fef0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0026.773] GetCurrentThreadId () returned 0x770 [0026.776] InitCommonControls () [0026.776] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74500000 [0026.776] GetProcAddress (hModule=0x74500000, lpProcName="InitCommonControlsEx") returned 0x74506be6 [0026.776] InitCommonControlsEx (picce=0x18ff34) returned 1 [0026.780] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x315968 [0026.780] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1c20000 [0026.780] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x316968 [0026.780] VirtualAlloc (lpAddress=0x1c20000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c20000 [0026.783] RegisterClipboardFormatA (lpszFormat="inner message") returned 0xc053 [0026.785] GetSystemTime (in: lpSystemTime=0x18ff2c | out: lpSystemTime=0x18ff2c*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x5, wHour=0x2, wMinute=0x1, wSecond=0x1, wMilliseconds=0x2fc)) [0026.787] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe\"" [0026.790] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0026.790] GetClassInfoA (in: hInstance=0x400000, lpClassName="App", lpWndClass=0x18fe90 | out: lpWndClass=0x18fe90) returned 0 [0026.790] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_App", lpWndClass=0x18fdf8 | out: lpWndClass=0x18fdf8) returned 0 [0026.790] RegisterClassA (lpWndClass=0x18fe90) returned 0x1ac168 [0026.790] CreateWindowExA (dwExStyle=0x40000, lpClassName="obj_App", lpWindowName="", dwStyle=0x80ca0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x60132 [0027.151] SetPropA (hWnd=0x60132, lpString="SELF_", hData=0x1c203f8) returned 1 [0027.151] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x81, wParam=0x0, lParam=0x18fa40) returned 0x1 [0027.153] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.153] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x83, wParam=0x0, lParam=0x18fa2c) returned 0x0 [0027.257] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.257] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x1, wParam=0x0, lParam=0x18fa40) returned 0x0 [0027.257] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.257] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0027.257] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.257] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x3, wParam=0x0, lParam=0x190003) returned 0x0 [0027.257] SendMessageA (hWnd=0x60132, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.257] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.258] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.258] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.258] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x0 [0027.259] SendMessageA (hWnd=0x60132, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0027.259] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.259] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0027.259] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.260] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0xd, wParam=0x208, lParam=0x18e9c4) returned 0x0 [0027.260] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.260] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0027.260] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.260] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0027.260] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.260] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0027.261] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.261] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0xd, wParam=0x208, lParam=0x18ea24) returned 0x0 [0027.261] GetSystemMenu (hWnd=0x60132, bRevert=0) returned 0x12020b [0027.266] EnableMenuItem (hMenu=0x12020b, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0027.266] DeleteMenu (hMenu=0x12020b, uPosition=0xf000, uFlags=0x0) returned 1 [0027.266] DeleteMenu (hMenu=0x12020b, uPosition=0xf010, uFlags=0x0) returned 1 [0027.266] DeleteMenu (hMenu=0x12020b, uPosition=0xf030, uFlags=0x0) returned 1 [0027.266] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0027.266] GetClassInfoA (in: hInstance=0x400000, lpClassName="Form", lpWndClass=0x18fe0c | out: lpWndClass=0x18fe0c) returned 0 [0027.266] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_Form", lpWndClass=0x18fd74 | out: lpWndClass=0x18fd74) returned 0 [0027.266] RegisterClassA (lpWndClass=0x18fe0c) returned 0xc166 [0027.266] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_Form", lpWindowName="", dwStyle=0x6cf0000, X=-2147483648, Y=-2147483648, nWidth=64, nHeight=64, hWndParent=0x60132, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x7001c [0027.266] SetPropA (hWnd=0x7001c, lpString="SELF_", hData=0x1c20a34) returned 1 [0027.266] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x24, wParam=0x0, lParam=0x18f9c8) returned 0x0 [0027.266] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.267] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x81, wParam=0x0, lParam=0x18f9bc) returned 0x1 [0027.267] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.267] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x83, wParam=0x0, lParam=0x18f9a8) returned 0x0 [0027.267] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.267] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x1, wParam=0x0, lParam=0x18f9bc) returned 0x0 [0027.267] SendMessageA (hWnd=0x7001c, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.267] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.267] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.267] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.267] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x0 [0027.268] SendMessageA (hWnd=0x7001c, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0027.268] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.268] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0027.268] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.268] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0xd, wParam=0x208, lParam=0x18e940) returned 0x0 [0027.268] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.268] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0027.268] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.268] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0027.268] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.268] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0027.269] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.269] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0xd, wParam=0x208, lParam=0x18e9a0) returned 0x0 [0027.269] LoadIconA (hInstance=0x400000, lpIconName="ICON0") returned 0x80193 [0027.270] SendMessageA (hWnd=0x60132, Msg=0x80, wParam=0x1, lParam=0x80193) returned 0x0 [0027.270] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.270] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x80, wParam=0x1, lParam=0x80193) returned 0x0 [0027.271] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.271] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0xd, wParam=0x208, lParam=0x18ea58) returned 0x0 [0027.271] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.271] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0xa00e3 [0027.271] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.271] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0xd, wParam=0x208, lParam=0x18eab8) returned 0x0 [0027.271] SendMessageA (hWnd=0x7001c, Msg=0x80, wParam=0x1, lParam=0x80193) returned 0x0 [0027.271] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.271] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x80, wParam=0x1, lParam=0x80193) returned 0x0 [0027.272] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.272] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0xd, wParam=0x208, lParam=0x18ea58) returned 0x0 [0027.272] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.272] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x500c3 [0027.272] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.272] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0xd, wParam=0x208, lParam=0x18eab8) returned 0x0 [0027.272] SetWindowLongA (hWnd=0x60132, nIndex=-20, dwNewLong=129) returned 262400 [0027.273] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.273] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x7c, wParam=0xffffffec, lParam=0x18fe64) returned 0x0 [0027.273] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.273] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x7d, wParam=0xffffffec, lParam=0x18fe64) returned 0x0 [0027.273] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.273] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0xd, wParam=0x208, lParam=0x18e9a0) returned 0x0 [0027.273] SetWindowPos (hWnd=0x60132, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0027.273] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.273] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x46, wParam=0x0, lParam=0x18fe9c) returned 0x0 [0027.273] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.273] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x83, wParam=0x1, lParam=0x18fe74) returned 0x0 [0027.274] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.274] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x47, wParam=0x0, lParam=0x18fe9c) returned 0x0 [0027.274] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.274] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x3, wParam=0x0, lParam=0x150003) returned 0x0 [0027.274] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.274] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0xd, wParam=0x208, lParam=0x18ea30) returned 0x0 [0027.274] InvalidateRect (hWnd=0x60132, lpRect=0x0, bErase=1) returned 1 [0027.274] InvalidateRect (hWnd=0x7001c, lpRect=0x0, bErase=1) returned 1 [0027.274] GetWindowRect (in: hWnd=0x7001c, lpRect=0x18feb0 | out: lpRect=0x18feb0) returned 1 [0027.274] GetWindowRect (in: hWnd=0x7001c, lpRect=0x18fe94 | out: lpRect=0x18fe94) returned 1 [0027.274] SetWindowPos (hWnd=0x7001c, hWndInsertAfter=0x0, X=0, Y=125, cx=132, cy=64, uFlags=0x14) returned 1 [0027.274] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.274] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x46, wParam=0x0, lParam=0x18fe40) returned 0x0 [0027.274] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.275] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x24, wParam=0x0, lParam=0x18fb68) returned 0x0 [0027.275] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.275] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x47, wParam=0x0, lParam=0x18fe40) returned 0x0 [0027.275] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.275] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x3, wParam=0x0, lParam=0x9b0008) returned 0x0 [0027.275] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.275] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0xd, wParam=0x208, lParam=0x18e9d4) returned 0x0 [0027.276] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.276] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x83, wParam=0x1, lParam=0x18fa24) returned 0x0 [0027.276] GetWindowRect (in: hWnd=0x7001c, lpRect=0x18feac | out: lpRect=0x18feac) returned 1 [0027.277] GetWindowRect (in: hWnd=0x7001c, lpRect=0x18fe94 | out: lpRect=0x18fe94) returned 1 [0027.277] SetWindowPos (hWnd=0x7001c, hWndInsertAfter=0x0, X=0, Y=0, cx=132, cy=64, uFlags=0x14) returned 1 [0027.277] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.277] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x46, wParam=0x0, lParam=0x18fe40) returned 0x0 [0027.277] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.277] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x24, wParam=0x0, lParam=0x18fb68) returned 0x0 [0027.277] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.277] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x47, wParam=0x0, lParam=0x18fe40) returned 0x0 [0027.277] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.277] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x3, wParam=0x0, lParam=0x1e0008) returned 0x0 [0027.277] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.277] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0xd, wParam=0x208, lParam=0x18e9d4) returned 0x0 [0027.277] GetWindowRect (in: hWnd=0x7001c, lpRect=0x18fec0 | out: lpRect=0x18fec0) returned 1 [0027.277] GetWindowRect (in: hWnd=0x7001c, lpRect=0x18fea4 | out: lpRect=0x18fea4) returned 1 [0027.277] SetWindowPos (hWnd=0x7001c, hWndInsertAfter=0x0, X=0, Y=0, cx=853, cy=455, uFlags=0x14) returned 1 [0027.278] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.278] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x46, wParam=0x0, lParam=0x18fe50) returned 0x0 [0027.278] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.278] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x24, wParam=0x0, lParam=0x18fb78) returned 0x0 [0027.278] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.278] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x83, wParam=0x1, lParam=0x18fe28) returned 0x0 [0027.278] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.278] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x47, wParam=0x0, lParam=0x18fe50) returned 0x0 [0027.278] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.278] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x5, wParam=0x0, lParam=0x1a10345) returned 0x0 [0027.278] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.278] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0xd, wParam=0x208, lParam=0x18e9e4) returned 0x0 [0027.279] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.279] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x83, wParam=0x1, lParam=0x18fa34) returned 0x0 [0027.279] GetWindowLongA (hWnd=0x7001c, nIndex=-16) returned 114229248 [0027.279] GetWindowLongA (hWnd=0x7001c, nIndex=-20) returned 65792 [0027.279] GetClassLongA (hWnd=0x7001c, nIndex=-26) returned 0x8 [0027.279] IsWindowEnabled (hWnd=0x7001c) returned 1 [0027.279] LoadCursorA (hInstance=0x0, lpCursorName=0x0) returned 0x0 [0027.279] CreateFontIndirectA (lplf=0x1c21165) returned 0x100a0797 [0027.280] SendMessageA (hWnd=0x7001c, Msg=0x30, wParam=0x100a0797, lParam=0xffff) returned 0x0 [0027.280] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.280] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x30, wParam=0x100a0797, lParam=0xffff) returned 0x0 [0027.280] InvalidateRect (hWnd=0x7001c, lpRect=0x0, bErase=1) returned 1 [0027.280] GetDC (hWnd=0x0) returned 0xc0106a3 [0027.280] GetDeviceCaps (hdc=0xc0106a3, index=90) returned 96 [0027.280] ReleaseDC (hWnd=0x0, hDC=0xc0106a3) returned 1 [0027.280] CreateFontIndirectA (lplf=0x1c21165) returned 0x1e0a0851 [0027.280] SendMessageA (hWnd=0x7001c, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x0 [0027.280] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.280] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x0 [0027.280] InvalidateRect (hWnd=0x7001c, lpRect=0x0, bErase=1) returned 1 [0027.280] DeleteObject (ho=0x100a0797) returned 1 [0027.280] SendMessageA (hWnd=0x7001c, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x0 [0027.280] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.280] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x0 [0027.280] InvalidateRect (hWnd=0x7001c, lpRect=0x0, bErase=1) returned 1 [0027.280] SetWindowPos (hWnd=0x7001c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x293) returned 1 [0027.280] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.280] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x46, wParam=0x0, lParam=0x18fe8c) returned 0x0 [0027.280] ShowWindow (hWnd=0x7001c, nCmdShow=0) returned 0 [0027.280] GetClientRect (in: hWnd=0x60132, lpRect=0x18feac | out: lpRect=0x18feac) returned 1 [0027.280] FindResourceA (hModule=0x400000, lpName="Str1", lpType=0x64) returned 0x421158 [0027.280] LoadResource (hModule=0x400000, hResInfo=0x421158) returned 0x41dd60 [0027.280] LockResource (hResData=0x41dd60) returned 0x41dd60 [0027.281] FreeResource (hResData=0x41dd60) returned 0 [0027.281] LoadCursorA (hInstance=0x0, lpCursorName=0x0) returned 0x0 [0027.281] GetClientRect (in: hWnd=0x7001c, lpRect=0x18fe8c | out: lpRect=0x18fe8c) returned 1 [0027.281] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.281] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.281] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.281] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0027.281] GetClassInfoA (in: hInstance=0x400000, lpClassName="EDIT", lpWndClass=0x18fe7c | out: lpWndClass=0x18fe7c) returned 1 [0027.281] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_EDIT", lpWndClass=0x18fde4 | out: lpWndClass=0x18fde4) returned 0 [0027.281] RegisterClassA (lpWndClass=0x18fe7c) returned 0xc0b0 [0027.281] CreateWindowExA (dwExStyle=0x10200, lpClassName="obj_EDIT", lpWindowName=0x0, dwStyle=0x460100c0, X=560, Y=60, nWidth=50, nHeight=20, hWndParent=0x7001c, hMenu=0x8000, hInstance=0x400000, lpParam=0x0) returned 0x50018 [0027.281] SetPropA (hWnd=0x50018, lpString="SELF_", hData=0x1c22b68) returned 1 [0027.281] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x81, wParam=0x0, lParam=0x18fa2c) returned 0x1 [0027.282] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.282] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x83, wParam=0x0, lParam=0x18fa18) returned 0x0 [0027.282] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.282] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x1, wParam=0x0, lParam=0x18fa2c) returned 0x1 [0027.283] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.283] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x5, wParam=0x0, lParam=0x10002e) returned 0x0 [0027.283] GetClientRect (in: hWnd=0x7001c, lpRect=0x18f89c | out: lpRect=0x18f89c) returned 1 [0027.283] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.283] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.283] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.283] GetClientRect (in: hWnd=0x50018, lpRect=0x18f89c | out: lpRect=0x18f89c) returned 1 [0027.283] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.283] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x3, wParam=0x0, lParam=0x3e0232) returned 0x0 [0027.283] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.283] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x210, wParam=0x80000001, lParam=0x50018) returned 0x0 [0027.283] SendMessageA (hWnd=0x50018, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.283] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.283] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.283] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.283] SendMessageA (hWnd=0x50018, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x1 [0027.283] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.283] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x1 [0027.285] SendMessageA (hWnd=0x50018, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x1 [0027.285] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.285] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x1 [0027.286] SetWindowPos (hWnd=0x50018, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x293) returned 1 [0027.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x46, wParam=0x0, lParam=0x18fe88) returned 0x0 [0027.286] ShowWindow (hWnd=0x50018, nCmdShow=5) returned 0 [0027.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.286] IsWindowVisible (hWnd=0x50018) returned 0 [0027.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0027.286] GetClientRect (in: hWnd=0x7001c, lpRect=0x18fea8 | out: lpRect=0x18fea8) returned 1 [0027.286] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.286] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.286] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.286] GetClientRect (in: hWnd=0x50018, lpRect=0x18fea8 | out: lpRect=0x18fea8) returned 1 [0027.286] ShowWindow (hWnd=0x50018, nCmdShow=5) returned 1 [0027.286] GetClientRect (in: hWnd=0x7001c, lpRect=0x18fea4 | out: lpRect=0x18fea4) returned 1 [0027.286] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.286] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.286] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.286] GetClientRect (in: hWnd=0x50018, lpRect=0x18fea4 | out: lpRect=0x18fea4) returned 1 [0027.286] SendMessageA (hWnd=0x50018, Msg=0xc5, wParam=0x0, lParam=0x0) returned 0x1 [0027.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xc5, wParam=0x0, lParam=0x0) returned 0x1 [0027.286] VirtualAlloc (lpAddress=0x1c24000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c24000 [0027.287] SetWindowTextA (hWnd=0x50018, lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 1 [0027.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xc, wParam=0x0, lParam=0x1c23238) returned 0x1 [0027.287] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.287] SendMessageA (hWnd=0x50018, Msg=0xb005, wParam=0x4008000, lParam=0x50018) returned 0x0 [0027.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xb005, wParam=0x4008000, lParam=0x50018) returned 0x0 [0027.287] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.287] SendMessageA (hWnd=0x50018, Msg=0xb005, wParam=0x3008000, lParam=0x50018) returned 0x0 [0027.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0027.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xb005, wParam=0x3008000, lParam=0x50018) returned 0x0 [0027.288] InvalidateRect (hWnd=0x50018, lpRect=0x0, bErase=1) returned 1 [0027.290] FindResourceA (hModule=0x400000, lpName="Str2", lpType=0x64) returned 0x421180 [0027.290] LoadResource (hModule=0x400000, hResInfo=0x421180) returned 0x41ee0c [0027.290] LockResource (hResData=0x41ee0c) returned 0x41ee0c [0027.290] FreeResource (hResData=0x41ee0c) returned 0 [0027.290] LoadCursorA (hInstance=0x0, lpCursorName=0x0) returned 0x0 [0027.290] GetClientRect (in: hWnd=0x7001c, lpRect=0x18fe8c | out: lpRect=0x18fe8c) returned 1 [0027.290] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.290] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.290] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.291] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.291] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.291] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.291] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0027.291] GetClassInfoA (in: hInstance=0x400000, lpClassName="EDIT", lpWndClass=0x18fe7c | out: lpWndClass=0x18fe7c) returned 1 [0027.291] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_EDIT", lpWndClass=0x18fde4 | out: lpWndClass=0x18fde4) returned 1 [0027.291] CreateWindowExA (dwExStyle=0x10200, lpClassName="obj_EDIT", lpWindowName=0x0, dwStyle=0x460100c0, X=65, Y=60, nWidth=195, nHeight=20, hWndParent=0x7001c, hMenu=0x8001, hInstance=0x400000, lpParam=0x0) returned 0x50016 [0027.291] SetPropA (hWnd=0x50016, lpString="SELF_", hData=0x1c24b30) returned 1 [0027.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x81, wParam=0x0, lParam=0x18fa2c) returned 0x1 [0027.291] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x83, wParam=0x0, lParam=0x18fa18) returned 0x0 [0027.291] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x1, wParam=0x0, lParam=0x18fa2c) returned 0x1 [0027.291] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.292] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x5, wParam=0x0, lParam=0x1000bf) returned 0x0 [0027.292] GetClientRect (in: hWnd=0x7001c, lpRect=0x18f89c | out: lpRect=0x18f89c) returned 1 [0027.292] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.292] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.292] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.292] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.292] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.292] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.292] GetClientRect (in: hWnd=0x50016, lpRect=0x18f89c | out: lpRect=0x18f89c) returned 1 [0027.292] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.292] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x3, wParam=0x0, lParam=0x3e0043) returned 0x0 [0027.292] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.292] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x210, wParam=0x80010001, lParam=0x50016) returned 0x0 [0027.292] SendMessageA (hWnd=0x50016, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.293] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.293] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.293] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.293] SendMessageA (hWnd=0x50016, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x1 [0027.293] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.293] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x1 [0027.293] SendMessageA (hWnd=0x50016, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x1 [0027.293] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.293] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x30, wParam=0x1e0a0851, lParam=0xffff) returned 0x1 [0027.293] SetWindowPos (hWnd=0x50016, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x293) returned 1 [0027.293] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.293] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x46, wParam=0x0, lParam=0x18fe88) returned 0x0 [0027.294] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x47, wParam=0x0, lParam=0x18fe88) returned 0x0 [0027.294] ShowWindow (hWnd=0x50016, nCmdShow=5) returned 0 [0027.294] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.294] IsWindowVisible (hWnd=0x50016) returned 0 [0027.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0027.294] GetClientRect (in: hWnd=0x7001c, lpRect=0x18fea8 | out: lpRect=0x18fea8) returned 1 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] GetClientRect (in: hWnd=0x50016, lpRect=0x18fea8 | out: lpRect=0x18fea8) returned 1 [0027.294] ShowWindow (hWnd=0x50016, nCmdShow=5) returned 1 [0027.294] GetClientRect (in: hWnd=0x7001c, lpRect=0x18fea4 | out: lpRect=0x18fea4) returned 1 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] IsWindowVisible (hWnd=0x7001c) returned 0 [0027.294] GetClientRect (in: hWnd=0x50016, lpRect=0x18fea4 | out: lpRect=0x18fea4) returned 1 [0027.294] SendMessageA (hWnd=0x50016, Msg=0xc5, wParam=0x0, lParam=0x0) returned 0x1 [0027.294] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0xc5, wParam=0x0, lParam=0x0) returned 0x1 [0027.294] SetWindowTextA (hWnd=0x50016, lpString="C:\\Users") returned 1 [0027.294] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.295] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0xc, wParam=0x0, lParam=0x1c251f4) returned 0x1 [0027.295] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.295] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.295] SendMessageA (hWnd=0x50016, Msg=0xb005, wParam=0x4008001, lParam=0x50016) returned 0x0 [0027.295] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.295] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0xb005, wParam=0x4008001, lParam=0x50016) returned 0x0 [0027.295] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.295] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.295] SendMessageA (hWnd=0x50016, Msg=0xb005, wParam=0x3008001, lParam=0x50016) returned 0x0 [0027.295] GetPropA (hWnd=0x50016, lpString="SELF_") returned 0x1c24b30 [0027.295] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50016, Msg=0xb005, wParam=0x3008001, lParam=0x50016) returned 0x0 [0027.295] InvalidateRect (hWnd=0x50016, lpRect=0x0, bErase=1) returned 1 [0027.295] ShowWindow (hWnd=0x60132, nCmdShow=0) returned 0 [0027.295] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0027.295] GetClassInfoA (in: hInstance=0x400000, lpClassName="", lpWndClass=0x18fe60 | out: lpWndClass=0x18fe60) returned 0 [0027.295] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_", lpWndClass=0x18fdc8 | out: lpWndClass=0x18fdc8) returned 0 [0027.295] RegisterClassA (lpWndClass=0x18fe60) returned 0x3ec096 [0027.295] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x3025a [0027.295] SetPropA (hWnd=0x3025a, lpString="SELF_", hData=0x1c25f00) returned 1 [0027.295] NtdllDefWindowProc_A (hWnd=0x3025a, Msg=0x24, wParam=0x0, lParam=0x18fa1c) returned 0x0 [0027.296] GetPropA (hWnd=0x3025a, lpString="SELF_") returned 0x1c25f00 [0027.296] NtdllDefWindowProc_A (hWnd=0x3025a, Msg=0x81, wParam=0x0, lParam=0x18fa10) returned 0x1 [0027.296] GetPropA (hWnd=0x3025a, lpString="SELF_") returned 0x1c25f00 [0027.296] NtdllDefWindowProc_A (hWnd=0x3025a, Msg=0x83, wParam=0x0, lParam=0x18f9fc) returned 0x0 [0027.296] GetPropA (hWnd=0x3025a, lpString="SELF_") returned 0x1c25f00 [0027.296] NtdllDefWindowProc_A (hWnd=0x3025a, Msg=0x1, wParam=0x0, lParam=0x18fa10) returned 0x0 [0027.296] SendMessageA (hWnd=0x3025a, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.296] GetPropA (hWnd=0x3025a, lpString="SELF_") returned 0x1c25f00 [0027.296] NtdllDefWindowProc_A (hWnd=0x3025a, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0027.296] GetPropA (hWnd=0x3025a, lpString="SELF_") returned 0x1c25f00 [0027.296] SetTimer (hWnd=0x3025a, nIDEvent=0x1c259b8, uElapse=0xbb8, lpTimerFunc=0x40917c) returned 0x1c259b8 [0027.296] SetTimer (hWnd=0x3025a, nIDEvent=0x1c2431c, uElapse=0x1388, lpTimerFunc=0x40917c) returned 0x1c2431c [0027.296] SetTimer (hWnd=0x3025a, nIDEvent=0x1c244a0, uElapse=0x1b58, lpTimerFunc=0x40917c) returned 0x1c244a0 [0027.296] ShowWindow (hWnd=0x7001c, nCmdShow=0) returned 0 [0027.296] GetClientRect (in: hWnd=0x60132, lpRect=0x18ff24 | out: lpRect=0x18ff24) returned 1 [0027.296] WaitMessage () returned 1 [0027.622] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0027.630] TranslateMessage (lpMsg=0x18ff34) returned 0 [0027.630] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0027.630] GetPropA (hWnd=0x3025a, lpString="SELF_") returned 0x1c25f00 [0027.630] NtdllDefWindowProc_A (hWnd=0x3025a, Msg=0x1e, wParam=0x0, lParam=0x0) returned 0x0 [0027.630] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0027.630] TranslateMessage (lpMsg=0x18ff34) returned 0 [0027.630] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0027.630] GetPropA (hWnd=0x7001c, lpString="SELF_") returned 0x1c20a34 [0027.630] NtdllDefWindowProc_A (hWnd=0x7001c, Msg=0x1e, wParam=0x0, lParam=0x0) returned 0x0 [0027.630] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0027.630] TranslateMessage (lpMsg=0x18ff34) returned 0 [0027.630] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0027.630] GetPropA (hWnd=0x60132, lpString="SELF_") returned 0x1c203f8 [0027.631] NtdllDefWindowProc_A (hWnd=0x60132, Msg=0x1e, wParam=0x0, lParam=0x0) returned 0x0 [0027.631] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0027.631] TranslateMessage (lpMsg=0x18ff34) returned 0 [0027.631] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0027.631] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0027.631] WaitMessage () returned 1 [0030.303] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0030.303] TranslateMessage (lpMsg=0x18ff34) returned 0 [0030.303] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0030.303] GetUserNameA (in: lpBuffer=0x18fc07, pcbBuffer=0x18fd08 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18fd08) returned 1 [0030.309] GetComputerNameExA (in: NameType=0x1, lpBuffer=0x18fcf8, nSize=0x18fd08 | out: lpBuffer="XDuwTfOno", nSize=0x18fd08) returned 1 [0030.309] GetSystemInfo (in: lpSystemInfo=0x18fce4 | out: lpSystemInfo=0x18fce4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0030.309] GetVersionExA (in: lpVersionInformation=0x18fc40*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x1f, dwMinorVersion=0x1c26570, dwBuildNumber=0x402471, dwPlatformId=0x18fccc, szCSDVersion="Ñ$@") | out: lpVersionInformation=0x18fc40*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0030.309] CryptAcquireContextA (in: phProv=0x18fd4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fd4c*=0x31c820) returned 1 [0030.538] CryptCreateHash (in: hProv=0x31c820, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18fd04 | out: phHash=0x18fd04) returned 1 [0030.539] CryptHashData (hHash=0x31c7b8, pbData=0x1c268e0, dwDataLen=0x10, dwFlags=0x0) returned 1 [0030.539] CryptDeriveKey (in: hProv=0x31c820, Algid=0x6602, hBaseData=0x31c7b8, dwFlags=0x0, phKey=0x18fd48 | out: phKey=0x18fd48*=0x31b370) returned 1 [0030.540] CryptDestroyHash (hHash=0x31c7b8) returned 1 [0030.540] CryptEncrypt (in: hKey=0x31b370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1c26850*, pdwDataLen=0x18fd58*=0x82, dwBufLen=0x82 | out: pbData=0x1c26850, pdwDataLen=0x18fd58) returned 0 [0030.541] GetLastError () returned 0xea [0030.541] CryptEncrypt (in: hKey=0x31b370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1c26850*, pdwDataLen=0x18fd54*=0x82, dwBufLen=0x88 | out: pbData=0x1c26850*, pdwDataLen=0x18fd54*=0x88) returned 1 [0030.541] CryptDestroyKey (hKey=0x31b370) returned 1 [0030.541] CryptReleaseContext (hProv=0x31c820, dwFlags=0x0) returned 1 [0030.542] KillTimer (hWnd=0x3025a, uIDEvent=0x1c259b8) returned 1 [0030.542] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0030.542] WaitMessage () returned 1 [0032.475] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0032.475] TranslateMessage (lpMsg=0x18ff34) returned 0 [0032.475] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0032.476] GetSystemTime (in: lpSystemTime=0x18fd94 | out: lpSystemTime=0x18fd94*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x5, wHour=0x2, wMinute=0x1, wSecond=0x6, wMilliseconds=0x380)) [0032.478] KillTimer (hWnd=0x3025a, uIDEvent=0x1c2431c) returned 1 [0032.479] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0032.479] WaitMessage () returned 1 [0034.468] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0034.468] TranslateMessage (lpMsg=0x18ff34) returned 0 [0034.468] DispatchMessageA (lpMsg=0x18ff34) [0034.470] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x30, cFileName=".", cAlternateFileName="")) returned 0x31b370 [0034.470] FindNextFileA (in: hFindFile=0x31b370, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x30, cFileName="..", cAlternateFileName="")) returned 1 [0034.470] FindNextFileA (in: hFindFile=0x31b370, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x30, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0034.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b3b0 [0034.471] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.471] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0034.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f50c, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31c7b8 [0034.472] FindNextFileA (in: hFindFile=0x31c7b8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f50c, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.472] FindNextFileA (in: hFindFile=0x31c7b8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f50c, dwReserved1=0x77353c74, cFileName="Local", cAlternateFileName="")) returned 1 [0034.472] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31c7f8 [0034.472] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.472] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x77353c74, cFileName="Adobe", cAlternateFileName="")) returned 1 [0034.472] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31c8b0 [0034.473] FindNextFileA (in: hFindFile=0x31c8b0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.473] FindNextFileA (in: hFindFile=0x31c8b0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x77353c74, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0034.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31c838 [0034.473] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.474] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x77353c74, cFileName="10.0", cAlternateFileName="")) returned 1 [0034.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31e3e0 [0034.475] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.475] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x18eb6c, dwReserved1=0x77353c74, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0034.479] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.479] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.483] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.483] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.484] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27edc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.484] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.484] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27edc) returned 0x10ab [0034.484] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.485] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0034.485] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.485] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.485] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.485] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27de8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.485] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27de8) returned 0x10ab [0034.485] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.486] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Cache", cAlternateFileName="")) returned 1 [0034.486] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName=".", cAlternateFileName="")) returned 0x31e420 [0034.487] FindNextFileA (in: hFindFile=0x31e420, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="..", cAlternateFileName="")) returned 1 [0034.488] FindNextFileA (in: hFindFile=0x31e420, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0034.488] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.488] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.488] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.488] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.488] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d88, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.488] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.488] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d88) returned 0x10ab [0034.488] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.488] FindNextFileA (in: hFindFile=0x31e420, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0034.489] FindClose (in: hFindFile=0x31e420 | out: hFindFile=0x31e420) returned 1 [0034.489] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x187473, dwReserved1=0x18eabc, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0034.489] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.489] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.489] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.489] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.489] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d88, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.489] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.489] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d88) returned 0x10ab [0034.489] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.490] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0034.490] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.490] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.490] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.490] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.490] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d88, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.490] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.490] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d88) returned 0x10ab [0034.490] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\557365724361636865.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\557365724361636865.bin"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.495] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ea5 [0034.495] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0034.496] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0034.556] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12ea5, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x12ea5, lpOverlapped=0x0) returned 1 [0034.560] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x12eb0, lpOverlapped=0x0) returned 1 [0034.567] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.590] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.602] CloseHandle (hObject=0x100) returned 1 [0034.602] CloseHandle (hObject=0x104) returned 1 [0034.605] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\557365724361636865.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\557365724361636865.bin")) returned 0 [0034.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\557365724361636865.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\557365724361636865.bin")) returned 0x2020 [0034.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x325f08, dwReserved1=0x18ebdc, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0x31e4c8 [0034.605] FindNextFileA (in: hFindFile=0x31e4c8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x325f08, dwReserved1=0x18ebdc, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0034.605] FindClose (in: hFindFile=0x31e4c8 | out: hFindFile=0x31e4c8) returned 1 [0034.605] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin")) returned 1 [0034.607] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin")) returned 0xffffffff [0034.607] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0034.607] FindClose (in: hFindFile=0x31e3e0 | out: hFindFile=0x31e3e0) returned 1 [0034.607] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x77353c74, cFileName="10.0", cAlternateFileName="")) returned 0 [0034.607] FindClose (in: hFindFile=0x31c838 | out: hFindFile=0x31c838) returned 1 [0034.607] FindNextFileA (in: hFindFile=0x31c8b0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x77353c74, cFileName="Color", cAlternateFileName="")) returned 1 [0034.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName=".", cAlternateFileName="")) returned 0x31c838 [0034.607] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="..", cAlternateFileName="")) returned 1 [0034.608] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0034.608] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.608] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.608] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.608] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.608] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ee0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.608] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.608] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ee0) returned 0x10ab [0034.608] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.609] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Profiles", cAlternateFileName="")) returned 1 [0034.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x31e478 [0034.615] FindNextFileA (in: hFindFile=0x31e478, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0034.616] FindNextFileA (in: hFindFile=0x31e478, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0034.616] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.616] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.616] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.616] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.616] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f38, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.616] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.616] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f38) returned 0x10ab [0034.616] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\777363524742.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\777363524742.icc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.617] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102a0 [0034.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0034.617] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0034.670] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x102a0, lpOverlapped=0x0) returned 1 [0034.673] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x102b0, lpOverlapped=0x0) returned 1 [0034.675] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.697] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.709] CloseHandle (hObject=0x104) returned 1 [0034.709] CloseHandle (hObject=0x100) returned 1 [0034.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\777363524742.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\777363524742.icc")) returned 0 [0034.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\777363524742.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\777363524742.icc")) returned 0x2020 [0034.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x325f08, dwReserved1=0x18ebdc, cFileName="wscRGB.icc", cAlternateFileName="")) returned 0x31e3e0 [0034.711] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x325f08, dwReserved1=0x18ebdc, cFileName="wscRGB.icc", cAlternateFileName="")) returned 0 [0034.711] FindClose (in: hFindFile=0x31e3e0 | out: hFindFile=0x31e3e0) returned 1 [0034.711] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 1 [0034.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 0xffffffff [0034.712] FindNextFileA (in: hFindFile=0x31e478, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0034.712] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.712] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.713] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fd8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.713] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.713] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fd8) returned 0x10ab [0034.713] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\7773524742.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\7773524742.icc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.714] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa74 [0034.714] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0034.714] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0034.766] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa74, lpOverlapped=0x0) returned 1 [0034.768] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa80, lpOverlapped=0x0) returned 1 [0034.769] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.793] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.806] CloseHandle (hObject=0x100) returned 1 [0034.806] CloseHandle (hObject=0x104) returned 1 [0034.807] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\7773524742.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\7773524742.icc")) returned 0 [0034.807] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\7773524742.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\7773524742.icc")) returned 0x2020 [0034.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x325f08, dwReserved1=0x18ebdc, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0x31e3e0 [0034.807] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x325f08, dwReserved1=0x18ebdc, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0034.807] FindClose (in: hFindFile=0x31e3e0 | out: hFindFile=0x31e3e0) returned 1 [0034.807] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 1 [0034.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 0xffffffff [0034.808] FindNextFileA (in: hFindFile=0x31e478, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0034.808] FindClose (in: hFindFile=0x31e478 | out: hFindFile=0x31e478) returned 1 [0034.809] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Profiles", cAlternateFileName="")) returned 0 [0034.809] FindClose (in: hFindFile=0x31c838 | out: hFindFile=0x31c838) returned 1 [0034.809] FindNextFileA (in: hFindFile=0x31c8b0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x77353c74, cFileName="Color", cAlternateFileName="")) returned 0 [0034.809] FindClose (in: hFindFile=0x31c8b0 | out: hFindFile=0x31c8b0) returned 1 [0034.809] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77353c74, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0034.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x77353c74, cFileName="Color", cAlternateFileName="øÇ1")) returned 0xffffffff [0034.809] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77353c74, cFileName="Apps", cAlternateFileName="")) returned 1 [0034.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31c8b0 [0034.809] FindNextFileA (in: hFindFile=0x31c8b0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.809] FindNextFileA (in: hFindFile=0x31c8b0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x77353c74, cFileName="2.0", cAlternateFileName="")) returned 1 [0034.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x31c838 [0034.810] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0034.810] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Data", cAlternateFileName="")) returned 1 [0034.810] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31e468 [0034.811] FindNextFileA (in: hFindFile=0x31e468, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.811] FindNextFileA (in: hFindFile=0x31e468, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77353c74, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0034.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31e3e0 [0034.811] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.811] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77353c74, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0034.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31e420 [0034.811] FindNextFileA (in: hFindFile=0x31e420, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.811] FindNextFileA (in: hFindFile=0x31e420, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77353c74, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0034.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x31e4a8 [0034.812] FindNextFileA (in: hFindFile=0x31e4a8, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.812] FindNextFileA (in: hFindFile=0x31e4a8, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x77353c74, cFileName="Data", cAlternateFileName="")) returned 1 [0034.812] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31e4e8 [0034.813] FindNextFileA (in: hFindFile=0x31e4e8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.813] FindNextFileA (in: hFindFile=0x31e4e8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.813] FindClose (in: hFindFile=0x31e4e8 | out: hFindFile=0x31e4e8) returned 1 [0034.813] FindNextFileA (in: hFindFile=0x31e4a8, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x77353c74, cFileName="Data", cAlternateFileName="")) returned 0 [0034.813] FindClose (in: hFindFile=0x31e4a8 | out: hFindFile=0x31e4a8) returned 1 [0034.813] FindNextFileA (in: hFindFile=0x31e420, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77353c74, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0034.813] FindClose (in: hFindFile=0x31e420 | out: hFindFile=0x31e420) returned 1 [0034.813] FindNextFileA (in: hFindFile=0x31e3e0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77353c74, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0034.813] FindClose (in: hFindFile=0x31e3e0 | out: hFindFile=0x31e3e0) returned 1 [0034.813] FindNextFileA (in: hFindFile=0x31e468, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77353c74, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0034.813] FindClose (in: hFindFile=0x31e468 | out: hFindFile=0x31e468) returned 1 [0034.813] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed37, dwReserved1=0x18ed24, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0034.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb4a, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0034.814] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb4a, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.814] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb4a, dwReserved1=0x77353c74, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0034.814] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0034.815] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName="..", cAlternateFileName="")) returned 1 [0034.815] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0034.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0034.816] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.816] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x3, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0034.816] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.816] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.816] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.816] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.817] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.817] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.817] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f9c) returned 0x10ab [0034.817] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\476F6F676C655570646174655365747570.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\476f6f676c655570646174655365747570.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0034.819] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x113f58 [0034.819] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0034.819] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0034.871] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x113f58, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x113f58, lpOverlapped=0x0) returned 1 [0034.913] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x113f60, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x113f60, lpOverlapped=0x0) returned 1 [0034.937] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.960] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.971] CloseHandle (hObject=0x108) returned 1 [0034.971] CloseHandle (hObject=0x10c) returned 1 [0034.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\476F6F676C655570646174655365747570.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\476f6f676c655570646174655365747570.exe")) returned 0 [0034.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\476F6F676C655570646174655365747570.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\476f6f676c655570646174655365747570.exe")) returned 0x2020 [0034.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x328f18, dwReserved1=0x18e70c, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0x324fd8 [0034.986] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x328f18, dwReserved1=0x18e70c, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0034.986] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0034.986] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe")) returned 1 [0034.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe")) returned 0xffffffff [0034.987] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x3, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0034.987] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0034.987] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0034.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0034.997] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0034.997] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0034.997] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0034.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0034.997] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0034.998] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fd8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0034.998] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0034.998] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fd8) returned 0x10ab [0034.998] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0034.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0034.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\636C69636B6F6E63655F626F6F747374726170.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\636c69636b6f6e63655f626f6f747374726170.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.999] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c50 [0034.999] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0035.000] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0035.052] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3c50, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x3c50, lpOverlapped=0x0) returned 1 [0035.054] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x3c60, lpOverlapped=0x0) returned 1 [0035.055] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.080] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.093] CloseHandle (hObject=0x10c) returned 1 [0035.093] CloseHandle (hObject=0x108) returned 1 [0035.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\636C69636B6F6E63655F626F6F747374726170.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\636c69636b6f6e63655f626f6f747374726170.exe")) returned 0 [0035.094] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\636C69636B6F6E63655F626F6F747374726170.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\636c69636b6f6e63655f626f6f747374726170.exe")) returned 0x2020 [0035.094] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x328f18, dwReserved1=0x18e70c, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 0x324fd8 [0035.095] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x328f18, dwReserved1=0x18e70c, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 0 [0035.095] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0035.095] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe")) returned 1 [0035.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe")) returned 0xffffffff [0035.096] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1 [0035.096] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.096] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.096] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.096] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.096] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fd8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.097] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fd8) returned 0x10ab [0035.097] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.097] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 1 [0035.097] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.097] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.097] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.097] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.097] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.098] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.098] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 1 [0035.098] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.098] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.098] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.098] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.098] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.098] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.098] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.098] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.099] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 1 [0035.099] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.099] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.099] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.099] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.099] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fd8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.099] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.099] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fd8) returned 0x10ab [0035.099] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.100] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1 [0035.100] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.100] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.100] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.100] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.100] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ffc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.100] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.100] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ffc) returned 0x10ab [0035.100] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\476F6F676C655570646174655365747570.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\476f6f676c655570646174655365747570.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0035.101] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x113f58 [0035.101] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0035.101] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0035.160] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x113f58, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x113f58, lpOverlapped=0x0) returned 1 [0035.182] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x113f60, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x113f60, lpOverlapped=0x0) returned 1 [0035.203] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.226] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.237] CloseHandle (hObject=0x108) returned 1 [0035.237] CloseHandle (hObject=0x10c) returned 1 [0035.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\476F6F676C655570646174655365747570.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\476f6f676c655570646174655365747570.exe")) returned 0 [0035.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\476F6F676C655570646174655365747570.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\476f6f676c655570646174655365747570.exe")) returned 0x2020 [0035.250] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x328f18, dwReserved1=0x18e70c, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0x324fd8 [0035.250] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x328f18, dwReserved1=0x18e70c, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0 [0035.250] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0035.250] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe")) returned 1 [0035.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe")) returned 0xffffffff [0035.260] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0 [0035.260] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0035.260] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0035.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0035.270] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0035.270] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1 [0035.270] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.270] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.271] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.271] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ff4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ff4) returned 0x10ab [0035.271] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.271] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1 [0035.271] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.271] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.272] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.272] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.272] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.272] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.272] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1 [0035.272] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.272] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.272] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.272] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.273] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.273] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.273] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.273] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.273] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 1 [0035.273] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.273] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.273] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.273] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.273] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ff4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.273] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.273] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ff4) returned 0x10ab [0035.273] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.274] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 0 [0035.274] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0035.274] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0035.274] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0035.275] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb4a, dwReserved1=0x77353c74, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0035.275] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0035.275] FindNextFileA (in: hFindFile=0x31c838, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed37, dwReserved1=0x18ed24, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0035.275] FindClose (in: hFindFile=0x31c838 | out: hFindFile=0x31c838) returned 1 [0035.275] FindNextFileA (in: hFindFile=0x31c8b0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x77353c74, cFileName="2.0", cAlternateFileName="")) returned 0 [0035.275] FindClose (in: hFindFile=0x31c8b0 | out: hFindFile=0x31c8b0) returned 1 [0035.275] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77353c74, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0035.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77353c74, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0035.275] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 1 [0035.275] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77353c74, cFileName="..", cAlternateFileName="")) returned 0 [0035.275] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0035.275] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x77353c74, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0035.275] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.275] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.275] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.276] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.276] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.276] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.276] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fec) returned 0x10ab [0035.276] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.276] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="Google", cAlternateFileName="")) returned 1 [0035.276] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0035.276] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 1 [0035.276] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="Chrome", cAlternateFileName="")) returned 1 [0035.276] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed54, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0035.277] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed54, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0035.277] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed54, dwReserved1=0x18ed24, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0035.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0035.282] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.333] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0035.333] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0035.333] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.334] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0035.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0035.334] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.335] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1 [0035.335] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.335] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.335] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.335] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.335] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.335] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.335] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.335] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0035.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\6D65746164617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\6d65746164617461"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0035.337] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0035.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0035.337] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0035.403] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x10, lpOverlapped=0x0) returned 1 [0035.409] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.432] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.444] CloseHandle (hObject=0x100) returned 1 [0035.446] CloseHandle (hObject=0x10c) returned 1 [0035.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\6D65746164617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\6d65746164617461")) returned 0 [0035.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\6D65746164617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\6d65746164617461")) returned 0x2020 [0035.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329f10, dwReserved1=0x18e974, cFileName="metadata", cAlternateFileName="")) returned 0x325018 [0035.447] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329f10, dwReserved1=0x18e974, cFileName="metadata", cAlternateFileName="")) returned 0 [0035.447] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0035.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 1 [0035.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0035.448] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="reports", cAlternateFileName="")) returned 1 [0035.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x31c838, cFileName=".", cAlternateFileName="")) returned 0x325018 [0035.448] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x31c838, cFileName="..", cAlternateFileName="")) returned 1 [0035.448] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x31c838, cFileName="..", cAlternateFileName="")) returned 0 [0035.448] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0035.448] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0035.448] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.448] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.448] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.448] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.449] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.449] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.449] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.449] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0035.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\73657474696E6773.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\73657474696e6773.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0035.450] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28 [0035.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0035.450] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0035.503] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x28, lpOverlapped=0x0) returned 1 [0035.504] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x30, lpOverlapped=0x0) returned 1 [0035.505] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.528] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.539] CloseHandle (hObject=0x10c) returned 1 [0035.539] CloseHandle (hObject=0x100) returned 1 [0035.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\73657474696E6773.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\73657474696e6773.dat")) returned 0 [0035.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\73657474696E6773.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\73657474696e6773.dat")) returned 0x2020 [0035.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="settings.dat", cAlternateFileName="")) returned 0x325018 [0035.541] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0035.541] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0035.541] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 1 [0035.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 0xffffffff [0035.542] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0035.542] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0035.542] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0035.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0035.545] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="..", cAlternateFileName="")) returned 1 [0035.551] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="Cache", cAlternateFileName="")) returned 1 [0035.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x325018 [0035.552] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0035.552] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0xb400b2, dwReserved1=0x329f28, cFileName="data_0", cAlternateFileName="")) returned 1 [0035.552] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.552] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.552] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.552] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.552] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.552] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.553] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.553] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0035.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f30"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.555] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb000 [0035.556] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0035.556] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0035.666] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0xb000, lpOverlapped=0x0) returned 1 [0035.671] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb010, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xb010, lpOverlapped=0x0) returned 1 [0035.672] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.696] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.707] CloseHandle (hObject=0x10c) returned 1 [0035.707] CloseHandle (hObject=0x108) returned 1 [0035.708] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f30")) returned 0 [0035.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f30")) returned 0x2020 [0035.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="data_0", cAlternateFileName="")) returned 0x325058 [0035.709] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="data_0", cAlternateFileName="")) returned 0 [0035.709] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0035.709] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 1 [0035.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0035.710] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="data_1", cAlternateFileName="")) returned 1 [0035.710] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.710] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.710] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.710] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.711] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.711] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.711] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.711] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F31" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f31"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0035.711] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42000 [0035.711] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0035.712] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0035.763] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x42000, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x42000, lpOverlapped=0x0) returned 1 [0035.800] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x42010, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x42010, lpOverlapped=0x0) returned 1 [0035.806] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.829] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.840] CloseHandle (hObject=0x108) returned 1 [0035.840] CloseHandle (hObject=0x10c) returned 1 [0035.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F31" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f31")) returned 0 [0035.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F31" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f31")) returned 0x2020 [0035.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="data_1", cAlternateFileName="")) returned 0x325058 [0035.843] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="data_1", cAlternateFileName="")) returned 0 [0035.843] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0035.843] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 1 [0035.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0035.846] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="data_2", cAlternateFileName="")) returned 1 [0035.847] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.847] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.847] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.847] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.847] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.847] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.847] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.847] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0035.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F32" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f32"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.848] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0035.848] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0035.848] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0035.898] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x2000, lpOverlapped=0x0) returned 1 [0035.916] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x2010, lpOverlapped=0x0) returned 1 [0035.917] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.942] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.954] CloseHandle (hObject=0x10c) returned 1 [0035.954] CloseHandle (hObject=0x108) returned 1 [0035.955] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F32" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f32")) returned 0 [0035.955] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F32" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f32")) returned 0x2020 [0035.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="data_2", cAlternateFileName="")) returned 0x325058 [0035.955] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="data_2", cAlternateFileName="")) returned 0 [0035.955] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0035.956] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 1 [0035.956] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0035.956] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="data_3", cAlternateFileName="")) returned 1 [0035.957] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0035.957] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.957] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0035.957] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0035.957] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0035.957] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0035.957] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0035.957] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.958] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F33" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f33"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0035.958] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x402000 [0035.959] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0035.959] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0036.010] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x402000, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x402000, lpOverlapped=0x0) returned 1 [0036.177] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x402010, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x402010, lpOverlapped=0x0) returned 1 [0036.252] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.276] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.288] CloseHandle (hObject=0x108) returned 1 [0036.288] CloseHandle (hObject=0x10c) returned 1 [0036.444] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F33" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f33")) returned 0 [0036.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\646174615F33" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\646174615f33")) returned 0x2020 [0036.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="data_3", cAlternateFileName="")) returned 0x325058 [0036.445] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="data_3", cAlternateFileName="")) returned 0 [0036.445] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0036.445] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 1 [0036.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0036.447] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="index", cAlternateFileName="")) returned 1 [0036.447] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0036.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0036.447] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0036.448] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0036.448] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.448] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0036.448] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0036.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0036.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\696E646578" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\696e646578"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.449] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80170 [0036.449] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0036.450] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0036.504] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x80170, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x80170, lpOverlapped=0x0) returned 1 [0036.571] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x80180, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x80180, lpOverlapped=0x0) returned 1 [0036.583] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.607] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.618] CloseHandle (hObject=0x10c) returned 1 [0036.618] CloseHandle (hObject=0x108) returned 1 [0036.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\696E646578" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\696e646578")) returned 0 [0036.625] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\696E646578" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\696e646578")) returned 0x2020 [0036.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="index", cAlternateFileName="")) returned 0x325058 [0036.625] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="index", cAlternateFileName="")) returned 0 [0036.625] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0036.625] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 1 [0036.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0036.630] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="index", cAlternateFileName="")) returned 0 [0036.630] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0036.630] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0036.630] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0036.630] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.630] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0036.630] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0036.631] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0036.631] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.631] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0036.631] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0036.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.632] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\436F6F6B696573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\436f6f6b696573"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.633] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c00 [0036.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0036.633] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0036.686] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1c00, lpOverlapped=0x0) returned 1 [0036.689] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1c10, lpOverlapped=0x0) returned 1 [0036.690] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.714] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.725] CloseHandle (hObject=0x100) returned 1 [0036.725] CloseHandle (hObject=0x108) returned 1 [0036.726] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\436F6F6B696573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\436f6f6b696573")) returned 0 [0036.726] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\436F6F6B696573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\436f6f6b696573")) returned 0x2020 [0036.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="Cookies", cAlternateFileName="")) returned 0x325018 [0036.727] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="Cookies", cAlternateFileName="")) returned 0 [0036.727] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0036.727] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 1 [0036.728] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0036.728] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0036.728] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0036.728] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.728] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0036.728] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0036.728] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0036.728] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.728] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0036.728] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0036.729] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.729] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\436F6F6B6965732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\436f6f6b6965732d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.729] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0036.729] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0036.729] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0036.783] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x10, lpOverlapped=0x0) returned 1 [0036.784] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.807] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.819] CloseHandle (hObject=0x108) returned 1 [0036.819] CloseHandle (hObject=0x100) returned 1 [0036.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\436F6F6B6965732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\436f6f6b6965732d6a6f75726e616c")) returned 0 [0036.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\436F6F6B6965732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\436f6f6b6965732d6a6f75726e616c")) returned 0x2020 [0036.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 0x325018 [0036.820] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 0 [0036.820] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0036.820] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 1 [0036.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0036.821] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1 [0036.821] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0036.821] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.821] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0036.821] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0036.821] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0036.821] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.821] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0036.821] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0036.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\43757272656E742053657373696F6E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\43757272656e742053657373696f6e"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.823] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d6 [0036.823] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0036.823] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0036.875] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1d6, lpOverlapped=0x0) returned 1 [0036.875] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1e0, lpOverlapped=0x0) returned 1 [0036.876] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.899] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.911] CloseHandle (hObject=0x100) returned 1 [0036.911] CloseHandle (hObject=0x108) returned 1 [0036.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\43757272656E742053657373696F6E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\43757272656e742053657373696f6e")) returned 0 [0036.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\43757272656E742053657373696F6E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\43757272656e742053657373696f6e")) returned 0x2020 [0036.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 0x325018 [0036.912] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 0 [0036.912] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0036.912] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 1 [0036.913] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0036.913] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1 [0036.913] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0036.913] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.913] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0036.913] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0036.914] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0036.914] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0036.914] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0036.914] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0036.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\43757272656E742054616273" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\43757272656e742054616273"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.915] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126 [0036.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0036.915] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0036.972] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x126, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x126, lpOverlapped=0x0) returned 1 [0036.974] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x130, lpOverlapped=0x0) returned 1 [0036.975] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.998] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.009] CloseHandle (hObject=0x108) returned 1 [0037.009] CloseHandle (hObject=0x100) returned 1 [0037.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\43757272656E742054616273" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\43757272656e742054616273")) returned 0 [0037.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\43757272656E742054616273" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\43757272656e742054616273")) returned 0x2020 [0037.011] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 0x325018 [0037.011] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x32bf10, dwReserved1=0x18e974, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 0 [0037.011] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0037.011] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 1 [0037.012] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0037.013] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3036b0, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1 [0037.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x325018 [0037.016] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0037.016] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x329f28, cFileName="000003.log", cAlternateFileName="")) returned 1 [0037.016] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.016] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.016] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.016] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.017] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\303030303033.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.018] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0037.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.018] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.069] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x10, lpOverlapped=0x0) returned 1 [0037.070] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.093] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.105] CloseHandle (hObject=0x108) returned 1 [0037.105] CloseHandle (hObject=0x10c) returned 1 [0037.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\303030303033.log")) returned 0 [0037.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\303030303033.log")) returned 0x2020 [0037.107] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="000003.log", cAlternateFileName="")) returned 0x325058 [0037.107] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="000003.log", cAlternateFileName="")) returned 0 [0037.107] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.107] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log")) returned 1 [0037.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log")) returned 0xffffffff [0037.107] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0037.108] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.108] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.108] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.108] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.108] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.108] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.108] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.108] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\43555252454e54"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.110] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0037.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.110] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.161] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x10, lpOverlapped=0x0) returned 1 [0037.162] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x20, lpOverlapped=0x0) returned 1 [0037.163] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.186] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.197] CloseHandle (hObject=0x10c) returned 1 [0037.197] CloseHandle (hObject=0x108) returned 1 [0037.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\43555252454e54")) returned 0 [0037.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\43555252454e54")) returned 0x2020 [0037.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="CURRENT", cAlternateFileName="")) returned 0x325058 [0037.199] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="CURRENT", cAlternateFileName="")) returned 0 [0037.199] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.199] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 1 [0037.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0037.200] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="LOCK", cAlternateFileName="")) returned 1 [0037.200] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.200] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.200] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.201] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.201] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.201] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.201] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.201] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4c4f434b"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.202] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0037.202] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.202] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.254] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x10, lpOverlapped=0x0) returned 1 [0037.255] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.278] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.289] CloseHandle (hObject=0x108) returned 1 [0037.289] CloseHandle (hObject=0x10c) returned 1 [0037.290] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4c4f434b")) returned 0 [0037.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4c4f434b")) returned 0x2020 [0037.290] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOCK", cAlternateFileName="")) returned 0x325058 [0037.291] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOCK", cAlternateFileName="")) returned 0 [0037.291] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.291] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 1 [0037.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0037.291] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="LOG", cAlternateFileName="")) returned 1 [0037.291] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.291] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.291] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.291] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.291] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.292] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.292] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4c4f47"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.293] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7 [0037.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.293] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.346] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0xa7, lpOverlapped=0x0) returned 1 [0037.347] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xb0, lpOverlapped=0x0) returned 1 [0037.348] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.379] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.390] CloseHandle (hObject=0x10c) returned 1 [0037.390] CloseHandle (hObject=0x108) returned 1 [0037.392] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4c4f47")) returned 0 [0037.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4c4f47")) returned 0x2020 [0037.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOG", cAlternateFileName="")) returned 0x325058 [0037.393] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOG", cAlternateFileName="")) returned 0 [0037.393] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.393] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 1 [0037.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0037.394] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0037.394] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.394] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.394] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.394] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.394] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.395] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.395] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.395] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4d414e49464553542d303030303031"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.395] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29 [0037.395] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.396] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.447] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x29, lpOverlapped=0x0) returned 1 [0037.447] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x30, lpOverlapped=0x0) returned 1 [0037.465] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.491] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.502] CloseHandle (hObject=0x108) returned 1 [0037.502] CloseHandle (hObject=0x10c) returned 1 [0037.504] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4d414e49464553542d303030303031")) returned 0 [0037.504] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\4d414e49464553542d303030303031")) returned 0x2020 [0037.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0x325058 [0037.505] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0037.505] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.505] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001")) returned 1 [0037.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001")) returned 0xffffffff [0037.506] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0037.506] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0037.506] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x3036b0, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1 [0037.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0037.509] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0037.509] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="000003.log", cAlternateFileName="")) returned 1 [0037.509] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.509] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.509] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.509] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.510] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.510] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.510] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.510] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\303030303033.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.512] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x156 [0037.512] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.512] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.564] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x156, lpOverlapped=0x0) returned 1 [0037.565] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x160, lpOverlapped=0x0) returned 1 [0037.566] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.628] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.639] CloseHandle (hObject=0x10c) returned 1 [0037.639] CloseHandle (hObject=0x108) returned 1 [0037.640] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\303030303033.log")) returned 0 [0037.640] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\303030303033.log")) returned 0x2020 [0037.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="000003.log", cAlternateFileName="")) returned 0x325058 [0037.641] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="000003.log", cAlternateFileName="")) returned 0 [0037.641] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.641] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 1 [0037.642] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 0xffffffff [0037.642] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0037.642] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.642] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.642] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.642] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.642] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.642] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.642] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.642] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\43555252454e54"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.643] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0037.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.643] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.694] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x10, lpOverlapped=0x0) returned 1 [0037.695] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x20, lpOverlapped=0x0) returned 1 [0037.696] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.719] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.732] CloseHandle (hObject=0x108) returned 1 [0037.732] CloseHandle (hObject=0x10c) returned 1 [0037.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\43555252454e54")) returned 0 [0037.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\43555252454e54")) returned 0x2020 [0037.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="CURRENT", cAlternateFileName="")) returned 0x325058 [0037.734] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="CURRENT", cAlternateFileName="")) returned 0 [0037.734] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.734] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 1 [0037.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0037.735] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="LOCK", cAlternateFileName="")) returned 1 [0037.735] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.735] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.735] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.735] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.735] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.735] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.735] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.735] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4c4f434b"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.738] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0037.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.738] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.790] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x10, lpOverlapped=0x0) returned 1 [0037.791] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.814] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.826] CloseHandle (hObject=0x10c) returned 1 [0037.826] CloseHandle (hObject=0x108) returned 1 [0037.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4c4f434b")) returned 0 [0037.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4c4f434b")) returned 0x2020 [0037.827] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOCK", cAlternateFileName="")) returned 0x325058 [0037.827] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOCK", cAlternateFileName="")) returned 0 [0037.827] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.827] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 1 [0037.828] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0037.828] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="LOG", cAlternateFileName="")) returned 1 [0037.828] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.828] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.828] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.828] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.828] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.828] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.828] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.828] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4c4f47"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.830] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a [0037.830] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.830] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.881] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x9a, lpOverlapped=0x0) returned 1 [0037.882] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xa0, lpOverlapped=0x0) returned 1 [0037.883] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.906] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.917] CloseHandle (hObject=0x108) returned 1 [0037.917] CloseHandle (hObject=0x10c) returned 1 [0037.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4c4f47")) returned 0 [0037.919] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4c4f47")) returned 0x2020 [0037.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOG", cAlternateFileName="")) returned 0x325058 [0037.920] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOG", cAlternateFileName="")) returned 0 [0037.920] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0037.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 1 [0037.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0037.921] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0037.921] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0037.921] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.921] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0037.921] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0037.921] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0037.921] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0037.921] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0037.921] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0037.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0037.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4d414e49464553542d303030303031"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0037.922] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29 [0037.922] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0037.922] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0037.981] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x29, lpOverlapped=0x0) returned 1 [0037.982] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x30, lpOverlapped=0x0) returned 1 [0037.983] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.005] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.017] CloseHandle (hObject=0x10c) returned 1 [0038.017] CloseHandle (hObject=0x108) returned 1 [0038.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4d414e49464553542d303030303031")) returned 0 [0038.018] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\4d414e49464553542d303030303031")) returned 0x2020 [0038.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0x325058 [0038.018] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0038.018] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0038.018] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 1 [0038.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0038.019] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0038.019] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0038.020] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x3036b0, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1 [0038.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0038.023] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0038.024] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="000003.log", cAlternateFileName="")) returned 1 [0038.024] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.024] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.024] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.024] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.024] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.024] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.024] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.024] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.024] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\303030303033.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.025] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad [0038.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.025] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.077] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4ad, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x4ad, lpOverlapped=0x0) returned 1 [0038.079] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x4b0, lpOverlapped=0x0) returned 1 [0038.080] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.103] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.114] CloseHandle (hObject=0x108) returned 1 [0038.114] CloseHandle (hObject=0x10c) returned 1 [0038.115] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\303030303033.log")) returned 0 [0038.115] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\303030303033.log")) returned 0x2020 [0038.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="000003.log", cAlternateFileName="")) returned 0x325058 [0038.116] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="000003.log", cAlternateFileName="")) returned 0 [0038.116] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0038.116] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 1 [0038.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 0xffffffff [0038.117] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0038.117] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.117] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.117] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.117] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\43555252454e54"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.118] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0038.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.119] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.170] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x10, lpOverlapped=0x0) returned 1 [0038.171] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x20, lpOverlapped=0x0) returned 1 [0038.171] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.194] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.206] CloseHandle (hObject=0x10c) returned 1 [0038.206] CloseHandle (hObject=0x108) returned 1 [0038.207] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\43555252454e54")) returned 0 [0038.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\43555252454e54")) returned 0x2020 [0038.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="CURRENT", cAlternateFileName="")) returned 0x325058 [0038.207] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="CURRENT", cAlternateFileName="")) returned 0 [0038.207] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0038.207] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 1 [0038.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0038.208] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="LOCK", cAlternateFileName="")) returned 1 [0038.208] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.209] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.209] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.209] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.209] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4c4f434b"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.210] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0038.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.210] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.264] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x10, lpOverlapped=0x0) returned 1 [0038.265] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.288] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.299] CloseHandle (hObject=0x108) returned 1 [0038.299] CloseHandle (hObject=0x10c) returned 1 [0038.300] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4c4f434b")) returned 0 [0038.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4c4f434b")) returned 0x2020 [0038.301] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOCK", cAlternateFileName="")) returned 0x325058 [0038.301] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOCK", cAlternateFileName="")) returned 0 [0038.301] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0038.301] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 1 [0038.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0038.301] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="LOG", cAlternateFileName="")) returned 1 [0038.301] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.301] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.301] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.301] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.302] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.302] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.302] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.302] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.302] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.302] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4c4f47"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.303] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a [0038.303] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.303] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.355] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x9a, lpOverlapped=0x0) returned 1 [0038.356] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xa0, lpOverlapped=0x0) returned 1 [0038.357] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.397] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.408] CloseHandle (hObject=0x10c) returned 1 [0038.408] CloseHandle (hObject=0x108) returned 1 [0038.408] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4c4f47")) returned 0 [0038.409] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4c4f47")) returned 0x2020 [0038.409] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOG", cAlternateFileName="")) returned 0x325058 [0038.409] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="LOG", cAlternateFileName="")) returned 0 [0038.409] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0038.409] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 1 [0038.410] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0038.410] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0038.410] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.410] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.410] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.410] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.411] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.411] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.411] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.411] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4d414e49464553542d303030303031"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.411] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29 [0038.411] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.412] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.484] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x29, lpOverlapped=0x0) returned 1 [0038.485] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x30, lpOverlapped=0x0) returned 1 [0038.488] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.511] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.527] CloseHandle (hObject=0x108) returned 1 [0038.528] CloseHandle (hObject=0x10c) returned 1 [0038.531] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4d414e49464553542d303030303031")) returned 0 [0038.531] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\4d414e49464553542d303030303031")) returned 0x2020 [0038.532] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0x325058 [0038.532] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x32cf18, dwReserved1=0x18e70c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0038.532] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0038.532] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 1 [0038.533] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0038.533] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0038.533] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0038.533] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x3036b0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0038.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0038.536] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0038.536] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1 [0038.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd800d6, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0038.537] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd800d6, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0038.537] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd800d6, dwReserved1=0x31e3e0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0038.537] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325098 [0038.540] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.540] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0038.543] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.543] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.546] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.546] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.547] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0038.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636f6e5f313238.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.549] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2c [0038.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.549] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.601] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd2c, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xd2c, lpOverlapped=0x0) returned 1 [0038.605] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xd30, lpOverlapped=0x0) returned 1 [0038.607] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.629] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.640] CloseHandle (hObject=0x110) returned 1 [0038.640] CloseHandle (hObject=0x114) returned 1 [0038.642] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636f6e5f313238.png")) returned 0 [0038.643] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636f6e5f313238.png")) returned 0x2020 [0038.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_128.png", cAlternateFileName="")) returned 0x3250d8 [0038.643] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0038.643] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0038.643] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1 [0038.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0xffffffff [0038.644] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0038.644] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.644] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.644] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.644] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.645] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.645] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.645] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.645] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636f6e5f3136.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0038.646] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0038.646] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.646] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.699] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xa0, lpOverlapped=0x0) returned 1 [0038.700] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xb0, lpOverlapped=0x0) returned 1 [0038.701] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.726] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.739] CloseHandle (hObject=0x114) returned 1 [0038.739] CloseHandle (hObject=0x110) returned 1 [0038.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636f6e5f3136.png")) returned 0 [0038.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\69636f6e5f3136.png")) returned 0x2020 [0038.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_16.png", cAlternateFileName="")) returned 0x3250d8 [0038.740] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0038.740] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0038.741] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1 [0038.742] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0xffffffff [0038.742] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0038.742] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.742] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.742] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.742] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.742] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.742] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.742] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.743] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0038.744] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d61696e.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.745] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0038.745] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.745] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.798] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x5c, lpOverlapped=0x0) returned 1 [0038.799] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x60, lpOverlapped=0x0) returned 1 [0038.800] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.823] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.834] CloseHandle (hObject=0x110) returned 1 [0038.834] CloseHandle (hObject=0x114) returned 1 [0038.836] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d61696e.html")) returned 0 [0038.837] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d61696e.html")) returned 0x2020 [0038.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0x3250d8 [0038.837] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0 [0038.837] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0038.837] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1 [0038.838] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 0xffffffff [0038.838] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="main.js", cAlternateFileName="")) returned 1 [0038.838] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.838] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.838] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.838] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.839] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.839] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.839] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.839] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.839] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d61696e.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0038.841] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f [0038.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.841] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.893] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x5f, lpOverlapped=0x0) returned 1 [0038.894] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x60, lpOverlapped=0x0) returned 1 [0038.894] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.917] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.929] CloseHandle (hObject=0x114) returned 1 [0038.930] CloseHandle (hObject=0x110) returned 1 [0038.931] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d61696e.js")) returned 0 [0038.931] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d61696e.js")) returned 0x2020 [0038.931] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.js", cAlternateFileName="")) returned 0x3250d8 [0038.931] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.js", cAlternateFileName="")) returned 0 [0038.931] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0038.931] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1 [0038.932] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 0xffffffff [0038.932] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0038.932] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0038.932] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.932] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0038.933] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0038.933] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0038.933] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0038.933] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0038.933] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0038.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.934] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d5 [0038.934] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0038.934] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0038.986] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x2d5, lpOverlapped=0x0) returned 1 [0038.988] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x2e0, lpOverlapped=0x0) returned 1 [0038.989] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.012] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.023] CloseHandle (hObject=0x110) returned 1 [0039.023] CloseHandle (hObject=0x114) returned 1 [0039.025] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d616e6966657374.json")) returned 0 [0039.025] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\6d616e6966657374.json")) returned 0x2020 [0039.025] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0039.026] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0039.026] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0039.026] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 1 [0039.027] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 0xffffffff [0039.027] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0039.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0039.029] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0039.029] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName="ar", cAlternateFileName="")) returned 1 [0039.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.030] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0039.030] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.030] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.030] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.030] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.030] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.031] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0039.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.032] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.083] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x101, lpOverlapped=0x0) returned 1 [0039.084] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0039.085] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.108] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.119] CloseHandle (hObject=0x118) returned 1 [0039.119] CloseHandle (hObject=0x11c) returned 1 [0039.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\6d65737361676573.json")) returned 0 [0039.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\6d65737361676573.json")) returned 0x2020 [0039.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.121] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.121] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.121] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0039.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0039.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.122] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.122] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0039.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.122] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.122] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.122] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.122] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.123] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.132] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0039.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.132] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.185] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0039.186] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0039.188] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.211] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.222] CloseHandle (hObject=0x11c) returned 1 [0039.222] CloseHandle (hObject=0x118) returned 1 [0039.223] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0039.223] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0039.223] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.224] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.224] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.224] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0039.225] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0039.225] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.225] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.225] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0039.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.225] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.225] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.225] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.225] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.225] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.225] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.226] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.226] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.226] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.226] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.227] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0039.227] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.227] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.278] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0039.279] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0039.280] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.303] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.314] CloseHandle (hObject=0x118) returned 1 [0039.314] CloseHandle (hObject=0x11c) returned 1 [0039.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0039.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0039.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.316] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.316] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.316] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0039.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0039.317] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.317] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.317] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0039.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.317] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.317] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.317] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.317] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.317] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.317] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.318] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.318] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.318] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.318] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.319] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.319] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0039.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.320] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.382] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0039.383] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0039.384] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.406] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.417] CloseHandle (hObject=0x11c) returned 1 [0039.418] CloseHandle (hObject=0x118) returned 1 [0039.418] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0039.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0039.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.419] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.419] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.419] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0039.420] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0039.420] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.420] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.420] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0039.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.421] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.421] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.421] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.421] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.421] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.421] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.421] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.421] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.421] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.421] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.422] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0039.422] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.422] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.475] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0039.477] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0039.477] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.500] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.511] CloseHandle (hObject=0x118) returned 1 [0039.511] CloseHandle (hObject=0x11c) returned 1 [0039.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0039.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0039.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.512] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.512] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.512] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0039.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 0xffffffff [0039.513] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.513] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.513] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0039.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.514] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.514] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.514] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.514] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.514] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.514] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.514] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.514] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.514] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.530] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0039.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.531] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.612] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xea, lpOverlapped=0x0) returned 1 [0039.613] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0039.614] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.637] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.648] CloseHandle (hObject=0x11c) returned 1 [0039.649] CloseHandle (hObject=0x118) returned 1 [0039.650] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0039.650] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0039.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.650] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.650] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.650] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0039.651] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 0xffffffff [0039.651] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.651] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.651] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0039.651] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.652] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.652] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.652] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.652] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.652] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.652] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.652] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.652] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.652] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.652] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.653] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0039.653] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.653] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.704] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x112, lpOverlapped=0x0) returned 1 [0039.705] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0039.706] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.729] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.740] CloseHandle (hObject=0x118) returned 1 [0039.740] CloseHandle (hObject=0x11c) returned 1 [0039.742] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0039.743] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0039.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.743] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.743] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.743] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0039.744] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 0xffffffff [0039.744] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.744] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.744] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0039.744] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.744] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.744] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.744] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.744] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.745] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.745] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.745] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.745] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.745] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.745] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.746] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.746] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0039.746] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.747] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.797] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd6, lpOverlapped=0x0) returned 1 [0039.798] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0039.799] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.822] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.833] CloseHandle (hObject=0x11c) returned 1 [0039.833] CloseHandle (hObject=0x118) returned 1 [0039.834] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0 [0039.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0x2020 [0039.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.839] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.839] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.839] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0039.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0039.840] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.840] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.840] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="en_US", cAlternateFileName="")) returned 1 [0039.840] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.841] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.841] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.841] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.841] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.841] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.841] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.841] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.841] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.841] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.841] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.842] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.842] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.842] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0039.842] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.842] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.894] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd7, lpOverlapped=0x0) returned 1 [0039.894] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0039.905] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.929] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.939] CloseHandle (hObject=0x118) returned 1 [0039.940] CloseHandle (hObject=0x11c) returned 1 [0039.941] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\6d65737361676573.json")) returned 0 [0039.941] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\6d65737361676573.json")) returned 0x2020 [0039.941] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0039.941] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.942] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0039.942] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0039.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0039.943] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.943] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0039.943] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0039.943] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0039.946] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0039.946] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.946] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0039.946] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.946] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0039.946] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0039.947] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0039.947] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0039.947] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0039.947] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0039.947] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0039.947] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0039.948] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0039.948] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0039.948] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0039.999] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdf, lpOverlapped=0x0) returned 1 [0040.000] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0040.001] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.024] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.035] CloseHandle (hObject=0x11c) returned 1 [0040.035] CloseHandle (hObject=0x118) returned 1 [0040.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0040.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0040.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.036] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.036] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.037] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0040.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 0xffffffff [0040.038] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.038] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.038] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="es_419", cAlternateFileName="")) returned 1 [0040.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.038] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.038] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.038] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.038] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.038] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.038] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.039] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.039] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.039] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.039] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.040] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0040.040] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.040] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.091] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0040.093] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0040.094] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.116] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.127] CloseHandle (hObject=0x118) returned 1 [0040.127] CloseHandle (hObject=0x11c) returned 1 [0040.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\6d65737361676573.json")) returned 0 [0040.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\6d65737361676573.json")) returned 0x2020 [0040.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.129] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.129] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.129] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0040.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0040.130] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.130] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.130] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="et", cAlternateFileName="")) returned 1 [0040.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.131] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.131] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.131] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.131] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.131] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.131] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.132] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.132] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.132] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.132] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.133] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0040.133] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.133] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.184] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd6, lpOverlapped=0x0) returned 1 [0040.185] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0040.191] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.214] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.225] CloseHandle (hObject=0x11c) returned 1 [0040.225] CloseHandle (hObject=0x118) returned 1 [0040.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\6d65737361676573.json")) returned 0 [0040.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\6d65737361676573.json")) returned 0x2020 [0040.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.227] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.227] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0040.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 0xffffffff [0040.228] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.228] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.228] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0040.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.228] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.228] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.228] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.228] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.229] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.229] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.229] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.230] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0040.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.230] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.281] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd9, lpOverlapped=0x0) returned 1 [0040.282] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0040.283] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.306] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.317] CloseHandle (hObject=0x118) returned 1 [0040.317] CloseHandle (hObject=0x11c) returned 1 [0040.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0040.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0040.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.319] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.319] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.319] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0040.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0040.320] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.320] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.320] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0040.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.321] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.321] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.321] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.321] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.321] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.321] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.321] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.321] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.321] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.322] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.322] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0040.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.324] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.392] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0040.393] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0040.394] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.417] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.429] CloseHandle (hObject=0x11c) returned 1 [0040.429] CloseHandle (hObject=0x118) returned 1 [0040.430] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0040.430] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0040.430] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.430] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.430] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.430] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0040.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0040.431] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.431] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.431] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0040.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.432] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.432] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.432] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.432] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.432] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.432] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.432] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.432] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.432] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.433] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.433] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0040.433] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.434] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.488] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xde, lpOverlapped=0x0) returned 1 [0040.489] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0040.490] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.513] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.525] CloseHandle (hObject=0x118) returned 1 [0040.525] CloseHandle (hObject=0x11c) returned 1 [0040.525] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0040.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0040.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.526] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.526] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0040.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0040.527] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.527] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.527] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="he", cAlternateFileName="")) returned 1 [0040.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.537] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.537] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.537] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.537] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.537] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.537] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.537] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.537] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.537] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.537] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.538] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.538] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.538] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0040.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.539] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.597] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe1, lpOverlapped=0x0) returned 1 [0040.598] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0040.600] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.623] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.634] CloseHandle (hObject=0x11c) returned 1 [0040.635] CloseHandle (hObject=0x118) returned 1 [0040.636] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\6d65737361676573.json")) returned 0 [0040.637] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\6d65737361676573.json")) returned 0x2020 [0040.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.637] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.637] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.637] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0040.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 0xffffffff [0040.638] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.638] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.638] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0040.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.639] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.639] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.639] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.639] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.639] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.639] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.640] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.640] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.641] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x123 [0040.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.641] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.701] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x123, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x123, lpOverlapped=0x0) returned 1 [0040.702] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0040.703] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.726] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.737] CloseHandle (hObject=0x118) returned 1 [0040.737] CloseHandle (hObject=0x11c) returned 1 [0040.738] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0040.739] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0040.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.739] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.739] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.739] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0040.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0040.740] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.740] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.740] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0040.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.742] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.742] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.742] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.742] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.742] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.742] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.742] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.742] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.742] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.742] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.743] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0040.743] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.743] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.796] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe6, lpOverlapped=0x0) returned 1 [0040.797] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0040.797] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.821] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.832] CloseHandle (hObject=0x11c) returned 1 [0040.832] CloseHandle (hObject=0x118) returned 1 [0040.833] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0040.833] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0040.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.834] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.834] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.834] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0040.835] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0040.835] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.835] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.835] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0040.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.835] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.835] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.835] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.835] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.835] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.835] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.836] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.836] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.836] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.836] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.836] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.836] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.837] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0040.837] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.837] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.889] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0040.890] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0040.891] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.914] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.927] CloseHandle (hObject=0x118) returned 1 [0040.927] CloseHandle (hObject=0x11c) returned 1 [0040.928] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0040.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0040.929] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0040.929] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.929] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0040.929] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0040.930] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 0xffffffff [0040.930] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.930] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0040.930] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0040.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0040.931] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0040.931] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.931] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0040.931] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.931] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0040.931] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0040.932] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0040.932] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0040.932] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0040.932] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.932] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.932] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.933] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0040.933] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0040.933] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0040.984] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0040.985] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0040.986] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.009] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.021] CloseHandle (hObject=0x11c) returned 1 [0041.021] CloseHandle (hObject=0x118) returned 1 [0041.022] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0041.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0041.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.022] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.023] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.023] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0041.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 0xffffffff [0041.023] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.024] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.024] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0041.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.024] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.024] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.024] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.024] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.024] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.024] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.025] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.025] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.025] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.025] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.025] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0041.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.026] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0041.078] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xec, lpOverlapped=0x0) returned 1 [0041.079] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0041.080] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.104] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.116] CloseHandle (hObject=0x118) returned 1 [0041.116] CloseHandle (hObject=0x11c) returned 1 [0041.117] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0041.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0041.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.117] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.117] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.118] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0041.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0041.119] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.119] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.119] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0041.119] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.120] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.120] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.120] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.121] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.121] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.121] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.122] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0041.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.123] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0041.192] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe6, lpOverlapped=0x0) returned 1 [0041.193] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0041.195] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.226] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.250] CloseHandle (hObject=0x11c) returned 1 [0041.250] CloseHandle (hObject=0x118) returned 1 [0041.253] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0041.255] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0041.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.256] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.256] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.256] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0041.258] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0041.258] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.258] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.258] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0041.258] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.259] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.259] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.259] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.259] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.260] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.260] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.260] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.260] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.261] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.261] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.262] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe4 [0041.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.262] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0041.323] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe4, lpOverlapped=0x0) returned 1 [0041.324] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0041.325] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.353] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.428] CloseHandle (hObject=0x118) returned 1 [0041.428] CloseHandle (hObject=0x11c) returned 1 [0041.429] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0041.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0041.429] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.429] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.429] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.430] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0041.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0041.431] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.431] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.431] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0041.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.434] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.434] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.434] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.434] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.434] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.434] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.434] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.434] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.434] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.435] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.435] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0041.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.436] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0041.494] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe9, lpOverlapped=0x0) returned 1 [0041.495] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0041.496] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.521] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.532] CloseHandle (hObject=0x11c) returned 1 [0041.532] CloseHandle (hObject=0x118) returned 1 [0041.534] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0041.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0041.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.535] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.546] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.546] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0041.547] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0041.547] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.547] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.547] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ms", cAlternateFileName="")) returned 1 [0041.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.547] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.548] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.548] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.548] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.548] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.548] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.548] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.548] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.548] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.548] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.549] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0041.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.549] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0041.618] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd2, lpOverlapped=0x0) returned 1 [0041.619] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0041.620] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.642] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.663] CloseHandle (hObject=0x118) returned 1 [0041.663] CloseHandle (hObject=0x11c) returned 1 [0041.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\6d65737361676573.json")) returned 0 [0041.665] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\6d65737361676573.json")) returned 0x2020 [0041.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.665] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.665] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.665] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0041.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0041.666] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.666] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.667] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0041.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.668] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.668] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.668] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.668] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.668] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.668] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.669] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.669] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.669] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.669] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.670] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0041.670] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.670] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0041.721] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0041.723] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0041.724] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.747] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.758] CloseHandle (hObject=0x11c) returned 1 [0041.758] CloseHandle (hObject=0x118) returned 1 [0041.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0041.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0041.759] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.759] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.759] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.759] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0041.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0041.760] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.760] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.760] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="no", cAlternateFileName="")) returned 1 [0041.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.760] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.761] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.761] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.761] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.761] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.761] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.761] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.761] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.761] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.761] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.762] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.762] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb [0041.762] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.762] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0041.815] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xcb, lpOverlapped=0x0) returned 1 [0041.816] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0041.817] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.840] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.851] CloseHandle (hObject=0x118) returned 1 [0041.851] CloseHandle (hObject=0x11c) returned 1 [0041.852] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\6d65737361676573.json")) returned 0 [0041.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\6d65737361676573.json")) returned 0x2020 [0041.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.852] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.852] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.852] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0041.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 0xffffffff [0041.853] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.853] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.854] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0041.854] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.855] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.855] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.855] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.855] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.855] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.855] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.855] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.855] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.855] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.855] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.856] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.856] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0041.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.856] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0041.909] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd9, lpOverlapped=0x0) returned 1 [0041.910] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0041.911] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.935] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.949] CloseHandle (hObject=0x11c) returned 1 [0041.949] CloseHandle (hObject=0x118) returned 1 [0041.950] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0041.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0041.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0041.950] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.950] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0041.950] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0041.951] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0041.951] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.951] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0041.952] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0041.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0041.952] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0041.952] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.952] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0041.952] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.952] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0041.952] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0041.953] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0041.953] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0041.953] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0041.953] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0041.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0041.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0041.953] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0041.954] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0041.954] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.007] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xde, lpOverlapped=0x0) returned 1 [0042.008] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0042.009] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.033] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.045] CloseHandle (hObject=0x118) returned 1 [0042.045] CloseHandle (hObject=0x11c) returned 1 [0042.046] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0042.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0042.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.047] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.047] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.047] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0042.048] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0042.048] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.048] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.048] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0042.048] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.050] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.050] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.050] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.050] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.050] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.050] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.051] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.051] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.051] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.051] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.051] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.051] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.051] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0042.051] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.052] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.105] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0042.106] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0042.107] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.131] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.143] CloseHandle (hObject=0x11c) returned 1 [0042.143] CloseHandle (hObject=0x118) returned 1 [0042.144] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0042.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0042.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.145] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.145] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.145] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0042.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0042.146] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.146] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.146] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0042.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.146] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.146] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.146] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.146] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.146] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.146] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.147] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.147] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.147] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.147] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.148] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0042.148] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.148] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.201] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xde, lpOverlapped=0x0) returned 1 [0042.202] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0042.203] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.225] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.236] CloseHandle (hObject=0x118) returned 1 [0042.236] CloseHandle (hObject=0x11c) returned 1 [0042.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0042.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0042.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.246] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.246] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0042.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0042.247] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.248] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.248] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0042.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.249] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.249] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.249] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.249] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.249] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.249] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.249] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.249] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.249] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.249] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.250] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0042.250] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.251] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.304] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0042.305] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0042.320] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.343] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.354] CloseHandle (hObject=0x11c) returned 1 [0042.354] CloseHandle (hObject=0x118) returned 1 [0042.355] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0042.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0042.355] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.355] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.355] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.355] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0042.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0042.356] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.356] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.356] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0042.357] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.357] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.357] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.357] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.357] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.357] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.357] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.357] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.357] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.357] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.358] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.358] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0042.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.359] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.425] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe3, lpOverlapped=0x0) returned 1 [0042.426] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0042.427] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.450] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.461] CloseHandle (hObject=0x118) returned 1 [0042.461] CloseHandle (hObject=0x11c) returned 1 [0042.462] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0042.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0042.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.463] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.463] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.463] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0042.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0042.464] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.464] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.464] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0042.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.465] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.465] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.465] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.465] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.465] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.465] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.466] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.466] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.466] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.466] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.467] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0042.467] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.467] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.521] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdf, lpOverlapped=0x0) returned 1 [0042.522] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0042.523] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.546] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.567] CloseHandle (hObject=0x11c) returned 1 [0042.567] CloseHandle (hObject=0x118) returned 1 [0042.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0042.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0042.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.568] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.569] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.569] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0042.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0042.570] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.570] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.570] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0042.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.570] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.570] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.570] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.570] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.570] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.570] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.571] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.571] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.571] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.571] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.571] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0042.572] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.572] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.628] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x104, lpOverlapped=0x0) returned 1 [0042.629] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0042.630] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.654] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.665] CloseHandle (hObject=0x118) returned 1 [0042.666] CloseHandle (hObject=0x11c) returned 1 [0042.667] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0042.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0042.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.667] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.667] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.667] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0042.668] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0042.668] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.668] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.668] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sv", cAlternateFileName="")) returned 1 [0042.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.670] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.670] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.670] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.670] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.670] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.670] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.670] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.670] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.670] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.670] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.671] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0042.671] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.672] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.726] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe2, lpOverlapped=0x0) returned 1 [0042.727] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0042.727] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.764] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.779] CloseHandle (hObject=0x11c) returned 1 [0042.779] CloseHandle (hObject=0x118) returned 1 [0042.785] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\6d65737361676573.json")) returned 0 [0042.786] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\6d65737361676573.json")) returned 0x2020 [0042.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.786] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.786] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.786] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0042.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0042.787] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.787] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.787] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0042.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.788] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.788] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.791] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.791] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.795] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.795] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.795] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.795] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.795] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.796] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.797] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0042.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.797] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.858] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x104, lpOverlapped=0x0) returned 1 [0042.860] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0042.862] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.889] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.904] CloseHandle (hObject=0x118) returned 1 [0042.904] CloseHandle (hObject=0x11c) returned 1 [0042.905] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0042.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0042.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0042.906] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.906] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0042.906] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0042.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 0xffffffff [0042.908] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.908] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0042.908] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0042.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0042.909] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0042.909] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.909] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0042.909] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.909] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0042.909] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0042.910] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0042.910] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0042.910] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0042.910] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0042.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0042.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0042.910] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0042.910] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0042.911] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0042.972] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0042.973] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0042.974] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.000] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.014] CloseHandle (hObject=0x11c) returned 1 [0043.015] CloseHandle (hObject=0x118) returned 1 [0043.016] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0043.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0043.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0043.016] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.016] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0043.017] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0043.018] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0043.018] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.018] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0043.018] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0043.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0043.019] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0043.019] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.019] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.019] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.019] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.019] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.019] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.019] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.019] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.019] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0043.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0043.020] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e [0043.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.020] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.083] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10e, lpOverlapped=0x0) returned 1 [0043.084] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0043.086] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.115] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.128] CloseHandle (hObject=0x118) returned 1 [0043.128] CloseHandle (hObject=0x11c) returned 1 [0043.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0043.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0043.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0043.129] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.129] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0043.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0043.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0043.130] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.131] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0043.131] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0043.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0043.132] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0043.132] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.132] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.132] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.132] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.132] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.132] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.132] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.132] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.132] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0043.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0043.133] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0043.133] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.133] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.194] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xed, lpOverlapped=0x0) returned 1 [0043.195] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0043.196] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.221] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.232] CloseHandle (hObject=0x11c) returned 1 [0043.232] CloseHandle (hObject=0x118) returned 1 [0043.233] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0043.234] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0043.234] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0043.234] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.234] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0043.234] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0043.235] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0043.235] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.235] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0043.241] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0043.241] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0043.241] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0043.241] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.241] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.241] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.241] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.241] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.242] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.242] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.242] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.242] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0043.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0043.242] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0043.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.243] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.294] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd7, lpOverlapped=0x0) returned 1 [0043.295] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0043.296] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.319] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.330] CloseHandle (hObject=0x118) returned 1 [0043.330] CloseHandle (hObject=0x11c) returned 1 [0043.332] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0 [0043.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0x2020 [0043.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0043.333] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.333] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0043.333] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0043.334] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0043.334] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.334] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0043.334] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0043.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0043.334] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0043.334] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.334] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.334] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.334] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.334] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.335] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.335] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.335] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.335] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0043.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0043.336] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0043.336] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.336] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.401] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd1, lpOverlapped=0x0) returned 1 [0043.402] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0043.409] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.432] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.443] CloseHandle (hObject=0x11c) returned 1 [0043.443] CloseHandle (hObject=0x118) returned 1 [0043.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0043.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0043.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0043.447] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.447] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0043.447] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0043.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0043.448] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.448] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0043.448] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0043.448] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0043.448] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0043.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0043.449] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0043.449] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0043.449] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.449] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.449] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.449] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.450] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.450] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.450] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.450] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0043.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\636f6d70757465645f686173686573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0043.453] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0043.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.454] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.505] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x160, lpOverlapped=0x0) returned 1 [0043.506] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x170, lpOverlapped=0x0) returned 1 [0043.507] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.531] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.543] CloseHandle (hObject=0x110) returned 1 [0043.543] CloseHandle (hObject=0x118) returned 1 [0043.544] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0 [0043.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0x2020 [0043.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x325118 [0043.545] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0043.545] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0043.545] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0043.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0043.546] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0043.546] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.546] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.546] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.546] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0043.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0043.548] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0043.548] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.548] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.629] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x2b56, lpOverlapped=0x0) returned 1 [0043.630] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x2b60, lpOverlapped=0x0) returned 1 [0043.632] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.654] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.665] CloseHandle (hObject=0x118) returned 1 [0043.665] CloseHandle (hObject=0x110) returned 1 [0043.667] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0043.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0043.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0043.667] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0043.667] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0043.667] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0043.668] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0043.668] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0043.668] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0043.668] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0043.669] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0043.669] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd800d6, dwReserved1=0x31e3e0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0043.669] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0043.669] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="aohghmighlieiainnegkcijnfilokake", cAlternateFileName="AOHGHM~1")) returned 1 [0043.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0043.669] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0043.669] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0043.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x325098 [0043.674] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0043.674] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0043.674] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.674] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.674] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.674] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.674] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.674] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.674] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.675] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636f6e5f313238.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0043.676] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8d [0043.676] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.676] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.727] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc8d, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xc8d, lpOverlapped=0x0) returned 1 [0043.734] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xc90, lpOverlapped=0x0) returned 1 [0043.735] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.758] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.769] CloseHandle (hObject=0x114) returned 1 [0043.769] CloseHandle (hObject=0x110) returned 1 [0043.770] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636f6e5f313238.png")) returned 0 [0043.770] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636f6e5f313238.png")) returned 0x2020 [0043.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_128.png", cAlternateFileName="")) returned 0x3250d8 [0043.771] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0043.771] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0043.771] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1 [0043.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 0xffffffff [0043.772] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0043.772] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.772] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.773] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.773] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.773] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.773] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.773] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.773] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.773] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0043.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636f6e5f3136.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.775] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f [0043.775] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.775] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.827] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8f, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x8f, lpOverlapped=0x0) returned 1 [0043.828] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x90, lpOverlapped=0x0) returned 1 [0043.829] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.851] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.863] CloseHandle (hObject=0x110) returned 1 [0043.863] CloseHandle (hObject=0x114) returned 1 [0043.864] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636f6e5f3136.png")) returned 0 [0043.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\69636f6e5f3136.png")) returned 0x2020 [0043.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_16.png", cAlternateFileName="")) returned 0x3250d8 [0043.865] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0043.865] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0043.865] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1 [0043.866] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 0xffffffff [0043.866] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0043.866] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.866] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.866] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.866] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.866] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.866] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.866] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.866] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d61696e.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0043.867] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0043.867] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.867] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0043.922] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x5c, lpOverlapped=0x0) returned 1 [0043.923] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x60, lpOverlapped=0x0) returned 1 [0043.924] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.947] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.959] CloseHandle (hObject=0x114) returned 1 [0043.959] CloseHandle (hObject=0x110) returned 1 [0043.961] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d61696e.html")) returned 0 [0043.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d61696e.html")) returned 0x2020 [0043.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0x3250d8 [0043.961] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0 [0043.961] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0043.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 1 [0043.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 0xffffffff [0043.962] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="main.js", cAlternateFileName="")) returned 1 [0043.962] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0043.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0043.963] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0043.963] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0043.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0043.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0043.963] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0043.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0043.964] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d61696e.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.964] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b [0043.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0043.964] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.018] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5b, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x5b, lpOverlapped=0x0) returned 1 [0044.019] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x60, lpOverlapped=0x0) returned 1 [0044.020] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.043] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.055] CloseHandle (hObject=0x110) returned 1 [0044.055] CloseHandle (hObject=0x114) returned 1 [0044.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d61696e.js")) returned 0 [0044.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d61696e.js")) returned 0x2020 [0044.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.js", cAlternateFileName="")) returned 0x3250d8 [0044.056] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.js", cAlternateFileName="")) returned 0 [0044.056] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0044.057] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 1 [0044.057] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 0xffffffff [0044.057] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0044.058] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.058] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.058] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.058] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.058] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.058] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.058] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.058] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0044.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0044.059] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d5 [0044.059] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.059] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.112] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x2d5, lpOverlapped=0x0) returned 1 [0044.120] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x2e0, lpOverlapped=0x0) returned 1 [0044.121] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.144] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.155] CloseHandle (hObject=0x114) returned 1 [0044.155] CloseHandle (hObject=0x110) returned 1 [0044.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d616e6966657374.json")) returned 0 [0044.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\6d616e6966657374.json")) returned 0x2020 [0044.158] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0044.158] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0044.158] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0044.158] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 1 [0044.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 0xffffffff [0044.159] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0044.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0044.166] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0044.166] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName="ar", cAlternateFileName="")) returned 1 [0044.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.166] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0044.166] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.166] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.166] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.166] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.166] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.167] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.167] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.167] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0044.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0044.168] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6 [0044.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.168] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.222] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf6, lpOverlapped=0x0) returned 1 [0044.223] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0044.224] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.248] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.259] CloseHandle (hObject=0x118) returned 1 [0044.259] CloseHandle (hObject=0x11c) returned 1 [0044.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\6d65737361676573.json")) returned 0 [0044.264] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\6d65737361676573.json")) returned 0x2020 [0044.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0044.264] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.265] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0044.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0044.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0044.266] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.266] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0044.266] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0044.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.266] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0044.266] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.266] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.266] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.267] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.267] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.267] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.267] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.267] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.267] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0044.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0044.269] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0044.269] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.269] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.323] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x108, lpOverlapped=0x0) returned 1 [0044.324] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0044.325] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.348] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.375] CloseHandle (hObject=0x11c) returned 1 [0044.375] CloseHandle (hObject=0x118) returned 1 [0044.376] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0044.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0044.376] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0044.377] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.377] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0044.377] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0044.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0044.378] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.378] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0044.378] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0044.378] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.378] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0044.378] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.378] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.378] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.378] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.378] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.379] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.379] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.379] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.379] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0044.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0044.388] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0044.389] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.389] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.443] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xcf, lpOverlapped=0x0) returned 1 [0044.445] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0044.446] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.470] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.481] CloseHandle (hObject=0x118) returned 1 [0044.481] CloseHandle (hObject=0x11c) returned 1 [0044.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0044.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0044.484] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0044.484] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.484] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0044.484] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0044.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0044.485] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.485] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0044.489] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0044.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.489] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0044.489] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.489] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.489] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.489] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.490] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.490] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.490] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.490] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.490] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.490] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0044.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0044.492] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0044.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.493] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.549] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xde, lpOverlapped=0x0) returned 1 [0044.550] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0044.551] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.601] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.613] CloseHandle (hObject=0x11c) returned 1 [0044.614] CloseHandle (hObject=0x118) returned 1 [0044.615] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0044.615] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0044.615] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0044.616] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.616] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0044.616] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0044.617] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0044.617] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.617] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0044.617] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0044.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.617] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0044.617] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.617] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.617] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.617] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.617] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.618] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.618] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.618] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.618] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0044.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0044.619] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0044.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.619] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.673] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd8, lpOverlapped=0x0) returned 1 [0044.674] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0044.675] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.698] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.710] CloseHandle (hObject=0x118) returned 1 [0044.710] CloseHandle (hObject=0x11c) returned 1 [0044.711] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0044.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0044.712] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0044.712] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.712] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0044.712] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0044.713] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 0xffffffff [0044.713] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.713] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0044.713] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0044.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.714] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0044.714] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.714] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.714] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.714] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.714] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0044.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0044.716] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0044.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.716] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.769] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd9, lpOverlapped=0x0) returned 1 [0044.770] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0044.771] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.793] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.805] CloseHandle (hObject=0x11c) returned 1 [0044.805] CloseHandle (hObject=0x118) returned 1 [0044.806] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0044.806] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0044.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0044.806] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.806] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0044.806] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0044.807] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 0xffffffff [0044.807] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.807] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0044.808] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0044.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.808] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0044.808] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.808] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.808] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.808] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.808] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.808] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.808] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.809] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.809] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.809] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0044.809] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0044.809] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0044.809] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.810] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.862] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x104, lpOverlapped=0x0) returned 1 [0044.863] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0044.864] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.886] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.897] CloseHandle (hObject=0x118) returned 1 [0044.898] CloseHandle (hObject=0x11c) returned 1 [0044.898] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0044.899] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0044.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0044.899] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.899] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0044.899] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0044.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 0xffffffff [0044.900] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.900] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0044.900] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0044.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.900] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0044.901] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.901] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.901] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.901] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.901] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.901] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.901] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.901] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.901] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0044.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0044.903] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0044.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0044.903] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0044.956] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0044.957] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0044.958] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.980] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.992] CloseHandle (hObject=0x11c) returned 1 [0044.992] CloseHandle (hObject=0x118) returned 1 [0044.993] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0 [0044.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0x2020 [0044.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0044.994] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.994] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0044.994] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0044.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0044.995] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.995] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0044.995] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="en_US", cAlternateFileName="")) returned 1 [0044.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0044.995] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0044.995] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.995] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0044.995] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.996] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0044.996] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0044.996] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0044.996] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0044.996] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0044.996] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0044.996] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.010] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0045.010] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.011] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.071] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd1, lpOverlapped=0x0) returned 1 [0045.072] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0045.074] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.097] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.109] CloseHandle (hObject=0x118) returned 1 [0045.109] CloseHandle (hObject=0x11c) returned 1 [0045.111] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\6d65737361676573.json")) returned 0 [0045.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\6d65737361676573.json")) returned 0x2020 [0045.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0045.111] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.111] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0045.112] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0045.113] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0045.113] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.113] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0045.113] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0045.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0045.114] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0045.114] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.114] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0045.114] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.114] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0045.114] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0045.114] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0045.114] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.114] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0045.115] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0045.115] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.115] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.115] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0045.115] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.116] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.210] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xce, lpOverlapped=0x0) returned 1 [0045.211] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0045.212] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.235] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.246] CloseHandle (hObject=0x11c) returned 1 [0045.247] CloseHandle (hObject=0x118) returned 1 [0045.247] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0045.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0045.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0045.248] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.248] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0045.248] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0045.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 0xffffffff [0045.249] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.249] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0045.249] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="es_419", cAlternateFileName="")) returned 1 [0045.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0045.250] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0045.250] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.250] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0045.250] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.250] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0045.250] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0045.250] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0045.250] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.250] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0045.251] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0045.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.252] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0045.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.253] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.307] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xce, lpOverlapped=0x0) returned 1 [0045.308] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0045.309] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.341] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.352] CloseHandle (hObject=0x118) returned 1 [0045.352] CloseHandle (hObject=0x11c) returned 1 [0045.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\6d65737361676573.json")) returned 0 [0045.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\6d65737361676573.json")) returned 0x2020 [0045.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0045.354] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.354] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0045.354] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0045.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0045.355] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.355] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0045.355] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="et", cAlternateFileName="")) returned 1 [0045.355] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0045.355] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0045.355] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.355] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0045.355] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0045.356] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0045.356] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0045.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0045.356] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0045.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.358] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0045.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.358] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.427] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd8, lpOverlapped=0x0) returned 1 [0045.429] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0045.430] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.453] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.464] CloseHandle (hObject=0x11c) returned 1 [0045.464] CloseHandle (hObject=0x118) returned 1 [0045.465] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\6d65737361676573.json")) returned 0 [0045.466] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\6d65737361676573.json")) returned 0x2020 [0045.466] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0045.466] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.466] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0045.468] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0045.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 0xffffffff [0045.469] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.469] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0045.469] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0045.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0045.469] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0045.470] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.470] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0045.470] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.470] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0045.470] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0045.470] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0045.470] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.470] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0045.470] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0045.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.473] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0045.473] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.473] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.526] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd8, lpOverlapped=0x0) returned 1 [0045.527] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0045.528] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.551] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.570] CloseHandle (hObject=0x118) returned 1 [0045.570] CloseHandle (hObject=0x11c) returned 1 [0045.571] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0045.571] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0045.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0045.571] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.571] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0045.572] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0045.572] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0045.572] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.573] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0045.573] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0045.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0045.573] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0045.573] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.573] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0045.573] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.573] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0045.573] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0045.573] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0045.573] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.574] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0045.574] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0045.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.574] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb [0045.574] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.575] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.646] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdb, lpOverlapped=0x0) returned 1 [0045.647] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0045.648] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.673] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.685] CloseHandle (hObject=0x11c) returned 1 [0045.685] CloseHandle (hObject=0x118) returned 1 [0045.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0045.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0045.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0045.686] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.686] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0045.687] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0045.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0045.688] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.688] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0045.688] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0045.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0045.688] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0045.688] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.688] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0045.688] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.688] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0045.688] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0045.689] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0045.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0045.689] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0045.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.691] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0045.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.691] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.744] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd7, lpOverlapped=0x0) returned 1 [0045.745] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0045.746] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.769] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.781] CloseHandle (hObject=0x118) returned 1 [0045.781] CloseHandle (hObject=0x11c) returned 1 [0045.782] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0045.782] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0045.782] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0045.782] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.782] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0045.783] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0045.783] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0045.784] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.784] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0045.784] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="he", cAlternateFileName="")) returned 1 [0045.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0045.784] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0045.784] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.784] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0045.784] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.784] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0045.784] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0045.784] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0045.785] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.785] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0045.785] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0045.785] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.785] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.785] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0045.785] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.786] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.851] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0045.852] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0045.853] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.877] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.888] CloseHandle (hObject=0x11c) returned 1 [0045.889] CloseHandle (hObject=0x118) returned 1 [0045.889] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\6d65737361676573.json")) returned 0 [0045.890] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\6d65737361676573.json")) returned 0x2020 [0045.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0045.890] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.890] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0045.890] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0045.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 0xffffffff [0045.891] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.891] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0045.891] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0045.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0045.891] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0045.892] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.892] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0045.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0045.892] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0045.892] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0045.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0045.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0045.892] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0045.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0045.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0045.894] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117 [0045.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0045.895] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0045.959] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x117, lpOverlapped=0x0) returned 1 [0045.962] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0045.963] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.986] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.000] CloseHandle (hObject=0x118) returned 1 [0046.000] CloseHandle (hObject=0x11c) returned 1 [0046.004] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0046.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0046.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.005] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.005] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.005] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0046.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0046.006] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.006] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.006] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0046.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.007] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.007] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.009] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.009] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.012] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.012] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.013] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.013] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.013] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.013] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.014] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0046.014] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.014] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.067] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xeb, lpOverlapped=0x0) returned 1 [0046.068] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0046.069] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.093] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.104] CloseHandle (hObject=0x11c) returned 1 [0046.104] CloseHandle (hObject=0x118) returned 1 [0046.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0046.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0046.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.106] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.106] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.106] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0046.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0046.107] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.107] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.107] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0046.107] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.108] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.108] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.108] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.108] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.108] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.108] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.108] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.108] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.108] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.108] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.111] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0046.111] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.112] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.169] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd1, lpOverlapped=0x0) returned 1 [0046.170] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0046.171] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.194] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.206] CloseHandle (hObject=0x118) returned 1 [0046.206] CloseHandle (hObject=0x11c) returned 1 [0046.207] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0046.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0046.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.207] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.207] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0046.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 0xffffffff [0046.209] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.209] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.209] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0046.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.209] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.209] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.209] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.209] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.209] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.210] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.210] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.210] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.210] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0046.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.211] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.270] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd5, lpOverlapped=0x0) returned 1 [0046.275] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0046.276] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.299] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.312] CloseHandle (hObject=0x11c) returned 1 [0046.312] CloseHandle (hObject=0x118) returned 1 [0046.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0046.313] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0046.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.313] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.313] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.313] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0046.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 0xffffffff [0046.315] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.315] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.315] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0046.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.315] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.315] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.315] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.315] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.315] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.315] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.316] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.316] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.316] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.316] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.319] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.319] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0046.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.319] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.383] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0046.384] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0046.385] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.409] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.421] CloseHandle (hObject=0x118) returned 1 [0046.421] CloseHandle (hObject=0x11c) returned 1 [0046.422] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0046.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0046.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.423] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.423] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.423] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0046.424] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0046.424] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.424] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.424] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0046.424] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.424] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.424] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.424] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.424] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.424] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.424] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.425] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.425] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.425] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.425] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.426] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0046.426] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.426] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.481] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xda, lpOverlapped=0x0) returned 1 [0046.481] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0046.482] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.506] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.517] CloseHandle (hObject=0x11c) returned 1 [0046.517] CloseHandle (hObject=0x118) returned 1 [0046.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0046.518] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0046.518] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.518] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.519] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.519] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0046.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0046.520] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.520] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.520] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0046.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.520] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.520] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.520] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.520] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.520] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.520] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.521] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.521] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.528] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe4 [0046.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.529] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.599] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe4, lpOverlapped=0x0) returned 1 [0046.600] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0046.601] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.624] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.635] CloseHandle (hObject=0x118) returned 1 [0046.635] CloseHandle (hObject=0x11c) returned 1 [0046.636] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0046.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0046.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.646] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.646] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.646] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0046.647] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0046.647] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.647] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.648] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0046.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.648] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.648] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.648] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.648] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.648] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.648] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.649] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.649] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.649] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.649] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.649] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0046.649] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.650] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.703] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0046.704] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0046.705] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.728] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.742] CloseHandle (hObject=0x11c) returned 1 [0046.742] CloseHandle (hObject=0x118) returned 1 [0046.743] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0046.743] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0046.744] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.744] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.744] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.744] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0046.745] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0046.745] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.745] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.745] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ms", cAlternateFileName="")) returned 1 [0046.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.745] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.745] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.745] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.745] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.746] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.746] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.746] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.746] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.746] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.746] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.746] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.749] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.749] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0046.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.750] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.806] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xcf, lpOverlapped=0x0) returned 1 [0046.807] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0046.808] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.834] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.845] CloseHandle (hObject=0x118) returned 1 [0046.845] CloseHandle (hObject=0x11c) returned 1 [0046.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\6d65737361676573.json")) returned 0 [0046.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\6d65737361676573.json")) returned 0x2020 [0046.846] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.847] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.847] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.847] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0046.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0046.848] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.848] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.848] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0046.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.848] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.848] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.848] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.848] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.848] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.848] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.849] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.849] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.849] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.849] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.850] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0046.850] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.850] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0046.926] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd9, lpOverlapped=0x0) returned 1 [0046.930] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0046.931] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.954] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.968] CloseHandle (hObject=0x11c) returned 1 [0046.969] CloseHandle (hObject=0x118) returned 1 [0046.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0046.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0046.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0046.970] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.970] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0046.970] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0046.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0046.971] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.971] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0046.971] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="no", cAlternateFileName="")) returned 1 [0046.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0046.972] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0046.972] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.972] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0046.972] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.972] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0046.972] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0046.972] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0046.972] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0046.972] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0046.973] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0046.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0046.981] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0046.983] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc3 [0046.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0046.984] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.044] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc3, lpOverlapped=0x0) returned 1 [0047.045] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0047.046] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.068] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.087] CloseHandle (hObject=0x118) returned 1 [0047.088] CloseHandle (hObject=0x11c) returned 1 [0047.089] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\6d65737361676573.json")) returned 0 [0047.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\6d65737361676573.json")) returned 0x2020 [0047.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.089] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.089] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.089] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0047.090] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 0xffffffff [0047.090] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.090] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.090] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0047.090] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.091] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.091] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.091] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.091] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.091] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.091] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.091] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.091] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.091] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.091] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.092] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0047.092] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.092] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.145] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd5, lpOverlapped=0x0) returned 1 [0047.146] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0047.147] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.171] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.182] CloseHandle (hObject=0x11c) returned 1 [0047.182] CloseHandle (hObject=0x118) returned 1 [0047.183] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0047.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0047.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.184] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.184] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0047.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0047.185] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.185] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.185] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0047.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.185] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.185] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.185] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.185] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.185] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.185] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.186] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.186] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.186] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.186] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.199] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0047.199] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.200] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.254] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xce, lpOverlapped=0x0) returned 1 [0047.256] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0047.256] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.279] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.290] CloseHandle (hObject=0x118) returned 1 [0047.290] CloseHandle (hObject=0x11c) returned 1 [0047.291] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0047.292] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0047.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.293] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.293] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.293] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0047.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0047.294] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.294] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.294] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0047.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.294] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.294] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.294] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.295] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.295] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.295] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.295] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.295] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.295] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.295] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.296] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0047.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.296] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.360] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0047.361] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0047.362] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.399] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.410] CloseHandle (hObject=0x11c) returned 1 [0047.411] CloseHandle (hObject=0x118) returned 1 [0047.411] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0047.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0047.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.412] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.412] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.412] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0047.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0047.413] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.413] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.413] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0047.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.414] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.414] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.414] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.414] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.414] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.414] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.414] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.414] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.414] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.414] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.415] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.418] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0047.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.419] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.472] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd5, lpOverlapped=0x0) returned 1 [0047.473] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0047.474] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.500] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.512] CloseHandle (hObject=0x118) returned 1 [0047.512] CloseHandle (hObject=0x11c) returned 1 [0047.513] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0047.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0047.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.514] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.514] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.514] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0047.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0047.515] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.515] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.515] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0047.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.516] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.516] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.516] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.516] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.516] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.516] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.517] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a [0047.517] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.518] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.587] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10a, lpOverlapped=0x0) returned 1 [0047.588] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0047.589] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.625] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.654] CloseHandle (hObject=0x11c) returned 1 [0047.654] CloseHandle (hObject=0x118) returned 1 [0047.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0047.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0047.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.656] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.656] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.656] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0047.657] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0047.657] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.657] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.657] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0047.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.658] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.658] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.658] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.658] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.658] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.658] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.658] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.658] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.658] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.658] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.659] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.661] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0047.661] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.662] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.717] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0047.718] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0047.719] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.744] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.755] CloseHandle (hObject=0x118) returned 1 [0047.755] CloseHandle (hObject=0x11c) returned 1 [0047.756] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0047.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0047.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.756] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.756] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.757] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0047.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0047.758] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.758] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.758] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0047.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.758] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.758] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.758] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.758] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.758] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.758] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.759] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.759] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.759] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.759] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.761] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0047.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.762] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.816] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xda, lpOverlapped=0x0) returned 1 [0047.817] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0047.819] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.843] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.855] CloseHandle (hObject=0x11c) returned 1 [0047.855] CloseHandle (hObject=0x118) returned 1 [0047.857] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0047.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0047.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.857] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.857] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0047.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0047.858] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.858] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.858] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0047.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.859] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.859] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.859] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.859] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.859] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.859] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.859] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.859] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.859] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.859] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.861] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.861] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8 [0047.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.861] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0047.914] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf8, lpOverlapped=0x0) returned 1 [0047.914] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0047.916] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.940] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.957] CloseHandle (hObject=0x118) returned 1 [0047.957] CloseHandle (hObject=0x11c) returned 1 [0047.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0047.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0047.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0047.961] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.961] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0047.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0047.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0047.963] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.963] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0047.963] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sv", cAlternateFileName="")) returned 1 [0047.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0047.964] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0047.964] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.964] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0047.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0047.964] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0047.965] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0047.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0047.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0047.965] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0047.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0047.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0047.966] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0047.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0047.966] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.023] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd6, lpOverlapped=0x0) returned 1 [0048.024] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0048.025] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.049] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.060] CloseHandle (hObject=0x11c) returned 1 [0048.060] CloseHandle (hObject=0x118) returned 1 [0048.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\6d65737361676573.json")) returned 0 [0048.061] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\6d65737361676573.json")) returned 0x2020 [0048.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0048.062] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.062] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0048.062] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0048.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0048.063] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.063] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.063] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0048.063] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0048.063] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0048.063] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.063] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.063] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.063] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.063] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.064] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.064] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.064] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.064] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0048.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0048.066] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0048.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.066] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.119] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfe, lpOverlapped=0x0) returned 1 [0048.120] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0048.121] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.144] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.155] CloseHandle (hObject=0x118) returned 1 [0048.155] CloseHandle (hObject=0x11c) returned 1 [0048.156] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0048.156] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0048.157] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0048.157] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.157] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0048.157] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0048.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 0xffffffff [0048.158] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.158] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.158] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0048.158] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0048.158] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0048.158] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.158] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.158] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.158] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.159] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.159] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.159] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.159] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.159] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0048.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0048.160] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0048.160] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.160] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.213] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe3, lpOverlapped=0x0) returned 1 [0048.214] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0048.215] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.238] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.255] CloseHandle (hObject=0x11c) returned 1 [0048.255] CloseHandle (hObject=0x118) returned 1 [0048.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0048.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0048.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0048.257] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.257] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0048.257] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0048.261] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0048.261] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.261] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.262] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0048.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0048.262] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0048.262] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.262] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.262] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.262] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.262] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.263] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.263] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.263] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.263] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0048.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0048.264] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0048.264] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.265] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.317] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x108, lpOverlapped=0x0) returned 1 [0048.318] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0048.319] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.342] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.354] CloseHandle (hObject=0x118) returned 1 [0048.354] CloseHandle (hObject=0x11c) returned 1 [0048.356] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0048.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0048.356] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0048.357] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.357] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0048.357] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0048.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0048.358] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.358] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.358] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0048.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0048.358] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0048.358] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.358] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.358] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.358] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.358] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.359] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.359] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.359] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.359] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0048.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0048.360] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0048.360] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.360] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.431] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe1, lpOverlapped=0x0) returned 1 [0048.432] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0048.433] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.456] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.467] CloseHandle (hObject=0x11c) returned 1 [0048.467] CloseHandle (hObject=0x118) returned 1 [0048.468] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0048.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0048.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0048.469] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.469] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0048.469] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0048.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0048.470] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.470] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.470] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0048.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0048.470] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0048.471] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.471] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.471] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.471] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.471] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.471] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.471] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.471] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.471] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0048.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0048.472] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0048.472] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.472] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.528] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xce, lpOverlapped=0x0) returned 1 [0048.530] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0048.531] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.561] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.576] CloseHandle (hObject=0x118) returned 1 [0048.576] CloseHandle (hObject=0x11c) returned 1 [0048.578] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0 [0048.578] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0x2020 [0048.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0048.578] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.578] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0048.579] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0048.580] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0048.580] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.580] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.580] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0048.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0048.580] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0048.581] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.581] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.581] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.581] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.581] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.581] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.581] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.581] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.581] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.582] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0048.582] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0048.583] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0048.583] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.583] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.638] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xce, lpOverlapped=0x0) returned 1 [0048.639] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0048.640] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.679] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.690] CloseHandle (hObject=0x11c) returned 1 [0048.690] CloseHandle (hObject=0x118) returned 1 [0048.691] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0048.692] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0048.692] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0048.692] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.692] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0048.692] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0048.693] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0048.693] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.693] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.693] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0048.693] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0048.693] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0048.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0048.694] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0048.694] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0048.694] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.694] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.694] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.694] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.694] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.694] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.694] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.695] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0048.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\636f6d70757465645f686173686573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0048.699] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0048.699] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.699] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.751] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x160, lpOverlapped=0x0) returned 1 [0048.753] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x170, lpOverlapped=0x0) returned 1 [0048.754] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.777] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.788] CloseHandle (hObject=0x114) returned 1 [0048.788] CloseHandle (hObject=0x118) returned 1 [0048.790] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0 [0048.790] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0x2020 [0048.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x325118 [0048.791] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0048.791] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.791] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0048.792] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0048.792] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0048.792] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.792] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.792] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.792] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.792] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.792] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.792] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.792] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.793] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0048.793] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0048.793] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0048.793] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.794] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.847] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x2b56, lpOverlapped=0x0) returned 1 [0048.849] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x2b60, lpOverlapped=0x0) returned 1 [0048.850] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.873] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.885] CloseHandle (hObject=0x118) returned 1 [0048.885] CloseHandle (hObject=0x114) returned 1 [0048.886] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0048.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0048.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0048.887] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0048.887] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0048.887] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0048.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0048.888] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0048.888] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0048.888] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0048.888] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0048.888] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0048.888] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0048.888] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="apdfllckaahabafndbhieahigkjlhalf", cAlternateFileName="APDFLL~1")) returned 1 [0048.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0048.889] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0048.889] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="14.1_0", cAlternateFileName="")) returned 1 [0048.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x325098 [0048.892] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0048.892] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0048.892] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0048.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0048.892] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0048.892] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0048.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0048.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0048.893] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0048.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0048.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\313238.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0048.894] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a33 [0048.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0048.895] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0048.950] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a33, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x1a33, lpOverlapped=0x0) returned 1 [0048.961] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x1a40, lpOverlapped=0x0) returned 1 [0048.962] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.985] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.997] CloseHandle (hObject=0x110) returned 1 [0048.997] CloseHandle (hObject=0x114) returned 1 [0048.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\313238.png")) returned 0 [0048.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\313238.png")) returned 0x2020 [0048.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="128.png", cAlternateFileName="")) returned 0x3250d8 [0048.998] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="128.png", cAlternateFileName="")) returned 0 [0048.998] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0048.999] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1 [0049.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 0xffffffff [0049.000] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0049.000] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.000] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.000] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.000] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0049.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0049.001] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec [0049.001] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.001] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.055] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x3ec, lpOverlapped=0x0) returned 1 [0049.057] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x3f0, lpOverlapped=0x0) returned 1 [0049.058] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.081] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.093] CloseHandle (hObject=0x114) returned 1 [0049.093] CloseHandle (hObject=0x110) returned 1 [0049.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\6d616e6966657374.json")) returned 0 [0049.094] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\6d616e6966657374.json")) returned 0x2020 [0049.094] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0049.094] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0049.094] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0049.094] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 1 [0049.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 0xffffffff [0049.095] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0049.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a0118, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0049.097] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a0118, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0049.097] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a0118, dwReserved1=0x31e3e0, cFileName="ar", cAlternateFileName="")) returned 1 [0049.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.097] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0049.098] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.098] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.098] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.098] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.098] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.098] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.098] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.098] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.098] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.100] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0049.100] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.100] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.160] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x116, lpOverlapped=0x0) returned 1 [0049.161] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0049.166] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.189] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.202] CloseHandle (hObject=0x118) returned 1 [0049.203] CloseHandle (hObject=0x11c) returned 1 [0049.206] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\6d65737361676573.json")) returned 0 [0049.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\6d65737361676573.json")) returned 0x2020 [0049.206] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0049.206] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.207] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0049.207] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 1 [0049.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0049.208] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.208] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0049.208] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0049.208] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.208] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0049.208] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.213] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.213] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.214] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.214] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.214] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.214] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.215] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.215] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.216] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13f [0049.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.216] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.269] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x13f, lpOverlapped=0x0) returned 1 [0049.270] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x140, lpOverlapped=0x0) returned 1 [0049.271] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.294] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.305] CloseHandle (hObject=0x11c) returned 1 [0049.306] CloseHandle (hObject=0x118) returned 1 [0049.306] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0049.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0049.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0049.307] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.307] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0049.307] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 1 [0049.308] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0049.308] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.308] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0049.308] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0049.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.309] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0049.309] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.309] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.309] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.309] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.309] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.309] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.309] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.309] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.309] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.310] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.311] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0049.311] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.311] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.364] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x109, lpOverlapped=0x0) returned 1 [0049.365] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0049.379] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.402] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.413] CloseHandle (hObject=0x118) returned 1 [0049.414] CloseHandle (hObject=0x11c) returned 1 [0049.415] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0049.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0049.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0049.415] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.415] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0049.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 1 [0049.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0049.416] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.416] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0049.417] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0049.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.417] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0049.417] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.417] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.417] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.417] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.417] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.417] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.417] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.417] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.418] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.418] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0049.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.419] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.471] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x103, lpOverlapped=0x0) returned 1 [0049.477] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0049.478] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.501] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.513] CloseHandle (hObject=0x11c) returned 1 [0049.513] CloseHandle (hObject=0x118) returned 1 [0049.514] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0049.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0049.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0049.514] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.514] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0049.514] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 1 [0049.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0049.515] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.515] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0049.516] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0049.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.516] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0049.516] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.516] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.516] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.516] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.517] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.517] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.518] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3 [0049.518] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.519] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.572] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf3, lpOverlapped=0x0) returned 1 [0049.573] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0049.574] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.597] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.614] CloseHandle (hObject=0x118) returned 1 [0049.614] CloseHandle (hObject=0x11c) returned 1 [0049.615] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0049.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0049.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0049.616] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.616] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0049.616] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 1 [0049.618] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0049.618] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.619] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0049.619] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0049.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.619] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0049.619] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.619] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.619] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.619] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.619] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.620] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.620] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.620] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.620] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.620] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0049.620] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.621] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.684] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0049.685] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0049.686] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.709] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.720] CloseHandle (hObject=0x11c) returned 1 [0049.720] CloseHandle (hObject=0x118) returned 1 [0049.721] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0049.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0049.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0049.722] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.722] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0049.722] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 1 [0049.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0049.724] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.724] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0049.724] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0049.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.725] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0049.725] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.725] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.725] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.725] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.725] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.726] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.726] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.726] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.726] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.726] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.727] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x149 [0049.727] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.728] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.779] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x149, lpOverlapped=0x0) returned 1 [0049.780] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x150, lpOverlapped=0x0) returned 1 [0049.781] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.804] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.815] CloseHandle (hObject=0x118) returned 1 [0049.815] CloseHandle (hObject=0x11c) returned 1 [0049.816] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0049.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0049.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0049.817] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.817] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0049.817] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 1 [0049.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0049.818] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.818] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0049.818] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0049.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.818] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0049.818] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.818] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.818] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.818] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.819] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.819] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.819] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.819] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.819] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.820] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0049.820] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.820] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.877] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf9, lpOverlapped=0x0) returned 1 [0049.878] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0049.879] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.902] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.913] CloseHandle (hObject=0x11c) returned 1 [0049.914] CloseHandle (hObject=0x118) returned 1 [0049.915] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0 [0049.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0x2020 [0049.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0049.916] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.916] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0049.916] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0049.917] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0049.917] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.917] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0049.917] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="en_US", cAlternateFileName="")) returned 1 [0049.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0049.918] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0049.918] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.919] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0049.919] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.919] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0049.919] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0049.919] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0049.919] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0049.919] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0049.919] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0049.919] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0049.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.921] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0049.921] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0049.921] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0049.974] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf9, lpOverlapped=0x0) returned 1 [0049.975] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0049.976] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.999] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.012] CloseHandle (hObject=0x118) returned 1 [0050.012] CloseHandle (hObject=0x11c) returned 1 [0050.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\6d65737361676573.json")) returned 0 [0050.013] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\6d65737361676573.json")) returned 0x2020 [0050.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.013] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.013] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.014] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 1 [0050.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0050.015] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.015] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.015] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0050.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.015] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.015] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.015] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.015] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.015] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.015] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.016] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.016] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.016] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.017] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0050.017] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.017] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.069] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x103, lpOverlapped=0x0) returned 1 [0050.071] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0050.072] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.094] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.105] CloseHandle (hObject=0x11c) returned 1 [0050.105] CloseHandle (hObject=0x118) returned 1 [0050.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0050.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0050.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.108] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.108] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.108] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 1 [0050.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0050.109] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.109] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.113] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="es_419", cAlternateFileName="")) returned 1 [0050.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.113] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.113] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.113] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.113] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.113] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.113] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.114] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.114] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.114] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.114] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.115] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.115] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0050.115] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.116] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.168] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x103, lpOverlapped=0x0) returned 1 [0050.169] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0050.170] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.192] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.204] CloseHandle (hObject=0x118) returned 1 [0050.204] CloseHandle (hObject=0x11c) returned 1 [0050.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\6d65737361676573.json")) returned 0 [0050.205] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\6d65737361676573.json")) returned 0x2020 [0050.205] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.205] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.205] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.205] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 1 [0050.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0050.206] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.206] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.207] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="et", cAlternateFileName="")) returned 1 [0050.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.207] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.207] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.207] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.207] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.207] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.207] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.207] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.207] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.207] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.208] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.208] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.208] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.209] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0050.209] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.209] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.269] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfb, lpOverlapped=0x0) returned 1 [0050.270] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0050.271] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.296] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.307] CloseHandle (hObject=0x11c) returned 1 [0050.308] CloseHandle (hObject=0x118) returned 1 [0050.309] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\6d65737361676573.json")) returned 0 [0050.309] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\6d65737361676573.json")) returned 0x2020 [0050.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.309] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.309] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.309] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 1 [0050.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 0xffffffff [0050.310] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.310] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.310] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="eu", cAlternateFileName="")) returned 1 [0050.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.311] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.311] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.311] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.311] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.311] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.311] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.311] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.311] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.311] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.312] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.314] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3 [0050.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.314] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.382] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf3, lpOverlapped=0x0) returned 1 [0050.382] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0050.383] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.406] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.417] CloseHandle (hObject=0x118) returned 1 [0050.417] CloseHandle (hObject=0x11c) returned 1 [0050.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\6d65737361676573.json")) returned 0 [0050.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\6d65737361676573.json")) returned 0x2020 [0050.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.421] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.421] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.421] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 1 [0050.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 0xffffffff [0050.422] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.422] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.422] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0050.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.422] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.422] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.423] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.423] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.423] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.423] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.423] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.423] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.423] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.423] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.424] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0050.424] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.424] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.476] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x101, lpOverlapped=0x0) returned 1 [0050.477] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0050.478] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.501] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.512] CloseHandle (hObject=0x11c) returned 1 [0050.512] CloseHandle (hObject=0x118) returned 1 [0050.513] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0050.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0050.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.514] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.514] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.514] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 1 [0050.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0050.515] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.515] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.515] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0050.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.516] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.516] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.516] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.516] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.516] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.516] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.519] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.519] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0050.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.519] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.572] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x104, lpOverlapped=0x0) returned 1 [0050.573] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0050.574] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.597] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.608] CloseHandle (hObject=0x118) returned 1 [0050.609] CloseHandle (hObject=0x11c) returned 1 [0050.609] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0050.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0050.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.610] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.610] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 1 [0050.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0050.611] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.611] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.611] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0050.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.612] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.612] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.612] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.612] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.612] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.612] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.612] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.612] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.612] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.612] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.613] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.613] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.613] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc [0050.613] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.614] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.672] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfc, lpOverlapped=0x0) returned 1 [0050.673] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0050.674] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.697] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.708] CloseHandle (hObject=0x11c) returned 1 [0050.708] CloseHandle (hObject=0x118) returned 1 [0050.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0050.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0050.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.710] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.710] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.710] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 1 [0050.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0050.711] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.711] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.711] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="he", cAlternateFileName="")) returned 1 [0050.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.711] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.711] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.711] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.712] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.712] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.712] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.725] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0050.725] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.725] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.777] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x116, lpOverlapped=0x0) returned 1 [0050.778] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0050.779] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.802] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.813] CloseHandle (hObject=0x118) returned 1 [0050.813] CloseHandle (hObject=0x11c) returned 1 [0050.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\6d65737361676573.json")) returned 0 [0050.814] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\6d65737361676573.json")) returned 0x2020 [0050.814] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.815] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.815] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.815] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 1 [0050.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 0xffffffff [0050.816] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.816] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.816] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0050.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.816] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.816] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.816] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.816] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.816] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.817] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.817] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.817] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.817] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.817] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.818] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x159 [0050.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.818] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.873] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x159, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x159, lpOverlapped=0x0) returned 1 [0050.874] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x160, lpOverlapped=0x0) returned 1 [0050.875] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.898] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.909] CloseHandle (hObject=0x11c) returned 1 [0050.909] CloseHandle (hObject=0x118) returned 1 [0050.911] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0050.911] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0050.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0050.912] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.912] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0050.912] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 1 [0050.913] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0050.913] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.913] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0050.913] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="hr", cAlternateFileName="")) returned 1 [0050.913] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0050.913] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0050.913] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.913] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0050.913] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.913] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0050.913] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0050.914] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0050.914] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0050.914] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0050.914] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0050.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0050.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0050.915] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107 [0050.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0050.916] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0050.968] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x107, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x107, lpOverlapped=0x0) returned 1 [0050.969] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0050.970] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.998] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.010] CloseHandle (hObject=0x118) returned 1 [0051.010] CloseHandle (hObject=0x11c) returned 1 [0051.012] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\6d65737361676573.json")) returned 0 [0051.013] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\6d65737361676573.json")) returned 0x2020 [0051.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.013] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.013] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.014] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 1 [0051.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0051.015] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.015] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.015] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0051.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.016] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.016] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.016] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.016] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.016] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.017] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.017] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.017] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.018] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0051.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.018] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.075] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x108, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0051.078] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.103] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.115] CloseHandle (hObject=0x11c) returned 1 [0051.115] CloseHandle (hObject=0x118) returned 1 [0051.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0051.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0051.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.117] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.117] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.117] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 1 [0051.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0051.118] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.118] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.118] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0051.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.119] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.119] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.119] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.119] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.119] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.119] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.119] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.119] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.119] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.120] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.120] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.122] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105 [0051.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.122] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.181] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x105, lpOverlapped=0x0) returned 1 [0051.182] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0051.183] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.206] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.217] CloseHandle (hObject=0x118) returned 1 [0051.218] CloseHandle (hObject=0x11c) returned 1 [0051.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0051.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0051.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.219] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.219] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 1 [0051.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0051.221] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.221] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.221] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0051.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.221] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.221] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.221] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.221] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.221] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.221] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.222] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.222] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.222] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.222] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.229] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0051.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.229] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.282] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x102, lpOverlapped=0x0) returned 1 [0051.283] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0051.284] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.307] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.318] CloseHandle (hObject=0x11c) returned 1 [0051.318] CloseHandle (hObject=0x118) returned 1 [0051.319] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0051.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0051.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.320] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.320] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.320] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 1 [0051.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0051.321] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.321] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.321] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0051.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.322] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.322] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.322] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.322] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.322] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.322] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.322] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.322] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.322] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.322] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.324] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0051.324] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.324] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.391] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x125, lpOverlapped=0x0) returned 1 [0051.392] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0051.393] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.417] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.428] CloseHandle (hObject=0x118) returned 1 [0051.428] CloseHandle (hObject=0x11c) returned 1 [0051.429] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0051.430] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0051.430] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.430] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.430] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.430] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 1 [0051.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0051.431] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.431] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.431] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0051.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.432] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.432] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.432] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.432] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.432] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.432] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.432] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.432] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.432] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.432] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.433] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0051.433] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.433] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.486] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x119, lpOverlapped=0x0) returned 1 [0051.487] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0051.488] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.511] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.522] CloseHandle (hObject=0x11c) returned 1 [0051.522] CloseHandle (hObject=0x118) returned 1 [0051.523] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0051.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0051.524] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.524] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.524] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.524] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 1 [0051.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0051.525] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.525] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.525] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0051.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.526] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.526] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.526] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.526] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.526] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.526] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.526] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.526] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.526] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.526] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.528] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11d [0051.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.528] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.584] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x11d, lpOverlapped=0x0) returned 1 [0051.585] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0051.586] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.632] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.643] CloseHandle (hObject=0x118) returned 1 [0051.644] CloseHandle (hObject=0x11c) returned 1 [0051.646] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0051.648] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0051.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.648] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.648] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.648] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 1 [0051.650] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0051.650] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.650] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.650] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0051.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.651] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.651] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.651] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.651] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.651] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.651] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.652] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.652] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.652] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.652] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.652] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.652] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.653] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0051.653] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.653] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.710] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x102, lpOverlapped=0x0) returned 1 [0051.712] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0051.713] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.748] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.760] CloseHandle (hObject=0x11c) returned 1 [0051.760] CloseHandle (hObject=0x118) returned 1 [0051.762] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0051.763] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0051.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.763] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.763] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.763] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 1 [0051.764] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0051.764] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.764] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.764] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="ms", cAlternateFileName="")) returned 1 [0051.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.765] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.765] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.765] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.765] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.765] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.765] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.765] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.765] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.765] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.765] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.766] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.767] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0051.767] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.768] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.820] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfe, lpOverlapped=0x0) returned 1 [0051.822] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0051.823] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.848] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.860] CloseHandle (hObject=0x118) returned 1 [0051.860] CloseHandle (hObject=0x11c) returned 1 [0051.861] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\6d65737361676573.json")) returned 0 [0051.862] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\6d65737361676573.json")) returned 0x2020 [0051.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.862] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.862] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.862] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 1 [0051.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0051.863] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.863] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.863] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0051.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.863] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.863] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.864] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.864] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.864] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.864] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.864] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.864] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.864] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.864] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.864] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.865] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0051.865] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.865] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0051.920] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf2, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0051.921] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.952] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.963] CloseHandle (hObject=0x11c) returned 1 [0051.963] CloseHandle (hObject=0x118) returned 1 [0051.964] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0051.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0051.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0051.965] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.965] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0051.965] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 1 [0051.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0051.966] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.966] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0051.966] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="no", cAlternateFileName="")) returned 1 [0051.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0051.966] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0051.966] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.966] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0051.967] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.967] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0051.967] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0051.967] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0051.967] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0051.967] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0051.967] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0051.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0051.968] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0051.968] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0051.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0051.969] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.017] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xda, lpOverlapped=0x0) returned 1 [0052.018] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0052.019] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.047] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.059] CloseHandle (hObject=0x118) returned 1 [0052.059] CloseHandle (hObject=0x11c) returned 1 [0052.060] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\6d65737361676573.json")) returned 0 [0052.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\6d65737361676573.json")) returned 0x2020 [0052.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.061] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.061] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.061] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 1 [0052.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0052.062] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.062] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.062] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0052.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.062] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.062] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.062] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.062] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.063] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.063] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.063] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.063] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.063] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.063] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.064] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0052.064] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.064] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.112] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x101, lpOverlapped=0x0) returned 1 [0052.113] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0052.114] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.137] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.148] CloseHandle (hObject=0x11c) returned 1 [0052.148] CloseHandle (hObject=0x118) returned 1 [0052.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0052.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0052.149] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.149] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.149] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.150] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 1 [0052.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0052.150] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.151] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.151] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0052.151] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.151] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.151] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.151] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.151] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.151] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.152] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.153] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6 [0052.153] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.153] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.199] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf6, lpOverlapped=0x0) returned 1 [0052.200] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0052.201] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.224] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.235] CloseHandle (hObject=0x118) returned 1 [0052.235] CloseHandle (hObject=0x11c) returned 1 [0052.236] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0052.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0052.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.237] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.237] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.237] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0052.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0052.238] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.238] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.238] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0052.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.239] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.239] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.239] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.239] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.239] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.239] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.239] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.239] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.239] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.239] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.240] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.240] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0052.240] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.240] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.285] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x108, lpOverlapped=0x0) returned 1 [0052.285] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0052.286] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.309] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.320] CloseHandle (hObject=0x11c) returned 1 [0052.320] CloseHandle (hObject=0x118) returned 1 [0052.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0052.323] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0052.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.323] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.323] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.323] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0052.324] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0052.324] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.324] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.324] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0052.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.325] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.325] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.325] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.325] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.325] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.325] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.325] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.325] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.325] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.325] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.327] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.327] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0052.327] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.327] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.392] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x119, lpOverlapped=0x0) returned 1 [0052.393] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0052.394] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.416] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.428] CloseHandle (hObject=0x118) returned 1 [0052.428] CloseHandle (hObject=0x11c) returned 1 [0052.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0052.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0052.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.431] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.431] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.431] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 1 [0052.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0052.432] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.432] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.433] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0052.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.433] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.433] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.433] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.433] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.433] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.433] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.433] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.433] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.433] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.434] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.434] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152 [0052.434] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.435] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.484] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x152, lpOverlapped=0x0) returned 1 [0052.486] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x160, lpOverlapped=0x0) returned 1 [0052.487] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.509] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.521] CloseHandle (hObject=0x11c) returned 1 [0052.521] CloseHandle (hObject=0x118) returned 1 [0052.522] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0052.523] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0052.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.523] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.523] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.523] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 1 [0052.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0052.524] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.524] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.524] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0052.524] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.525] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.525] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.525] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.525] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.525] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.525] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.526] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.526] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.527] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0052.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.527] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.576] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x112, lpOverlapped=0x0) returned 1 [0052.576] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0052.577] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.600] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.613] CloseHandle (hObject=0x118) returned 1 [0052.613] CloseHandle (hObject=0x11c) returned 1 [0052.614] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0052.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0052.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.615] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.615] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.615] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 1 [0052.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0052.616] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.616] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.616] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0052.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.616] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.616] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.616] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.616] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.616] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.616] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.617] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.617] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.617] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.617] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.618] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c [0052.618] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.618] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.661] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10c, lpOverlapped=0x0) returned 1 [0052.662] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0052.663] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.686] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.697] CloseHandle (hObject=0x11c) returned 1 [0052.697] CloseHandle (hObject=0x118) returned 1 [0052.698] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0052.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0052.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.699] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.699] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 1 [0052.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0052.701] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.701] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.701] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0052.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.701] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.701] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.701] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.701] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.701] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.701] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.702] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.702] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.702] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.702] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.704] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11f [0052.704] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.705] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.757] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x11f, lpOverlapped=0x0) returned 1 [0052.758] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0052.759] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.781] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.803] CloseHandle (hObject=0x118) returned 1 [0052.803] CloseHandle (hObject=0x11c) returned 1 [0052.804] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0052.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.805] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.805] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.805] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 1 [0052.806] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0052.806] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.806] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.806] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="sv", cAlternateFileName="")) returned 1 [0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.806] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.806] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.806] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.807] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.807] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.807] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.807] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.807] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.807] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.807] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.807] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.808] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd [0052.808] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.808] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.851] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfd, lpOverlapped=0x0) returned 1 [0052.852] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0052.853] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.876] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.888] CloseHandle (hObject=0x11c) returned 1 [0052.888] CloseHandle (hObject=0x118) returned 1 [0052.889] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\6d65737361676573.json")) returned 0 [0052.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\6d65737361676573.json")) returned 0x2020 [0052.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.890] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.890] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.890] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 1 [0052.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0052.891] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.891] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.891] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0052.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.891] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.891] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.891] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.891] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.892] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.892] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.902] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164 [0052.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.903] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0052.947] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x164, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x164, lpOverlapped=0x0) returned 1 [0052.948] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x170, lpOverlapped=0x0) returned 1 [0052.949] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.972] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.983] CloseHandle (hObject=0x118) returned 1 [0052.984] CloseHandle (hObject=0x11c) returned 1 [0052.987] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0052.987] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0052.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0052.988] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.988] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0052.988] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 1 [0052.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0052.989] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.989] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0052.989] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0052.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0052.989] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0052.989] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.992] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0052.992] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.994] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0052.994] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0052.995] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0052.995] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0052.995] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0052.995] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0052.995] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0052.995] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0052.996] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e [0052.996] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0052.996] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.039] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10e, lpOverlapped=0x0) returned 1 [0053.040] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0053.041] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.065] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.077] CloseHandle (hObject=0x11c) returned 1 [0053.077] CloseHandle (hObject=0x118) returned 1 [0053.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0053.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0053.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0053.078] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.078] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0053.078] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 1 [0053.079] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0053.079] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.079] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0053.079] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0053.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0053.080] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0053.080] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.080] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.080] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.080] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.080] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.080] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.080] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.080] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.080] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0053.082] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0053.082] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161 [0053.082] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.082] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.125] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x161, lpOverlapped=0x0) returned 1 [0053.126] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x170, lpOverlapped=0x0) returned 1 [0053.127] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.150] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.161] CloseHandle (hObject=0x118) returned 1 [0053.161] CloseHandle (hObject=0x11c) returned 1 [0053.162] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0053.163] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0053.163] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0053.163] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.163] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0053.163] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 1 [0053.164] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0053.164] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.164] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0053.164] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0053.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0053.164] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0053.164] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.165] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.165] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.165] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.165] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.165] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.165] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.165] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.165] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.165] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0053.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0053.166] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117 [0053.166] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.166] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.209] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x117, lpOverlapped=0x0) returned 1 [0053.210] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0053.211] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.233] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.245] CloseHandle (hObject=0x11c) returned 1 [0053.245] CloseHandle (hObject=0x118) returned 1 [0053.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0053.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0053.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0053.246] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.246] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0053.247] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 1 [0053.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0053.247] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.248] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0053.248] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0053.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0053.248] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0053.248] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.248] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.248] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.248] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.248] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.249] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.249] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.249] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.249] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0053.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0053.251] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111 [0053.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.251] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.293] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x111, lpOverlapped=0x0) returned 1 [0053.294] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0053.295] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.321] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.334] CloseHandle (hObject=0x118) returned 1 [0053.335] CloseHandle (hObject=0x11c) returned 1 [0053.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0 [0053.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0x2020 [0053.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0053.337] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.337] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0053.337] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0053.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0053.338] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.338] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0053.338] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0053.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0053.339] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0053.339] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.339] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.339] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.339] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.339] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.340] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.340] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.340] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.340] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0053.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0053.341] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0053.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.341] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.403] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10b, lpOverlapped=0x0) returned 1 [0053.404] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0053.405] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.428] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.448] CloseHandle (hObject=0x11c) returned 1 [0053.449] CloseHandle (hObject=0x118) returned 1 [0053.450] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0053.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0053.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0053.450] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.450] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0053.451] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0053.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0053.451] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.452] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0053.452] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0053.452] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0053.452] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0053.452] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0053.452] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0053.452] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0053.452] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.452] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.452] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.453] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.453] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.453] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.453] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.453] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0053.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0053.455] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bd5 [0053.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.455] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.499] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2bd5, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x2bd5, lpOverlapped=0x0) returned 1 [0053.502] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x2be0, lpOverlapped=0x0) returned 1 [0053.504] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.527] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.538] CloseHandle (hObject=0x114) returned 1 [0053.539] CloseHandle (hObject=0x118) returned 1 [0053.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0053.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0053.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0053.540] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0053.540] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0053.541] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 1 [0053.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0053.542] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x11a6e6f, dwReserved1=0x31e3e0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0053.542] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0053.542] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0053.542] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0053.542] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="14.1_0", cAlternateFileName="")) returned 0 [0053.542] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0053.542] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1 [0053.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0053.543] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0053.543] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1 [0053.543] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x325098 [0053.546] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0053.546] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0053.546] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.546] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.546] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.547] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0053.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\313238.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0053.548] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4e [0053.548] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.549] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.633] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd4e, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xd4e, lpOverlapped=0x0) returned 1 [0053.635] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xd50, lpOverlapped=0x0) returned 1 [0053.636] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.663] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.677] CloseHandle (hObject=0x110) returned 1 [0053.677] CloseHandle (hObject=0x118) returned 1 [0053.679] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\313238.png")) returned 0 [0053.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\313238.png")) returned 0x2020 [0053.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="128.png", cAlternateFileName="")) returned 0x3250d8 [0053.680] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="128.png", cAlternateFileName="")) returned 0 [0053.680] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0053.680] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1 [0053.681] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 0xffffffff [0053.681] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0053.681] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.681] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.682] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.682] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.682] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.682] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.682] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.682] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.683] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0053.683] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0053.683] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d8 [0053.683] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.684] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.745] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x2d8, lpOverlapped=0x0) returned 1 [0053.758] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x2e0, lpOverlapped=0x0) returned 1 [0053.759] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.783] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.794] CloseHandle (hObject=0x118) returned 1 [0053.795] CloseHandle (hObject=0x110) returned 1 [0053.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\6d616e6966657374.json")) returned 0 [0053.796] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\6d616e6966657374.json")) returned 0x2020 [0053.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0053.796] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0053.796] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0053.797] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 1 [0053.797] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 0xffffffff [0053.797] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0053.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c011a, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0053.799] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c011a, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0053.799] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c011a, dwReserved1=0x31e3e0, cFileName="ar", cAlternateFileName="")) returned 1 [0053.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0053.800] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0053.800] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.800] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.800] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.800] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.800] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.800] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.800] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.800] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.800] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0053.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0053.801] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0053.801] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.801] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.845] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0053.845] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0053.846] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.870] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.881] CloseHandle (hObject=0x114) returned 1 [0053.881] CloseHandle (hObject=0x11c) returned 1 [0053.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\6d65737361676573.json")) returned 0 [0053.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\6d65737361676573.json")) returned 0x2020 [0053.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0053.884] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.884] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0053.884] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 1 [0053.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0053.885] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.885] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0053.885] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0053.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0053.886] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0053.886] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.886] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.886] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.886] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.887] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.887] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.887] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.887] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.887] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0053.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0053.888] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0053.888] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.888] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0053.932] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0053.934] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0053.935] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.967] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.979] CloseHandle (hObject=0x11c) returned 1 [0053.979] CloseHandle (hObject=0x114) returned 1 [0053.980] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0053.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0053.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0053.981] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.981] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0053.981] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 1 [0053.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0053.982] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.982] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0053.983] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0053.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0053.983] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0053.983] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.983] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0053.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.984] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0053.984] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0053.984] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0053.984] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0053.984] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0053.984] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0053.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0053.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0053.985] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0053.986] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0053.986] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.032] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.033] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.034] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.057] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.069] CloseHandle (hObject=0x114) returned 1 [0054.070] CloseHandle (hObject=0x11c) returned 1 [0054.071] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0054.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0054.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.072] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.072] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.072] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 1 [0054.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0054.073] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.073] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.073] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0054.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.075] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.075] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.075] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.075] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.075] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.075] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.075] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.075] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.075] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.075] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.076] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.077] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.130] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.131] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.133] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.156] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.167] CloseHandle (hObject=0x11c) returned 1 [0054.167] CloseHandle (hObject=0x114) returned 1 [0054.168] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0054.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0054.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.169] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.169] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.169] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 1 [0054.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0054.170] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.170] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.170] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0054.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.170] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.170] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.170] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.170] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.170] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.170] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.171] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.171] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.171] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.171] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.172] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.172] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.172] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.214] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.215] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.216] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.239] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.250] CloseHandle (hObject=0x114) returned 1 [0054.250] CloseHandle (hObject=0x11c) returned 1 [0054.251] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0054.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0054.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.252] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.252] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.252] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 1 [0054.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 0xffffffff [0054.253] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.253] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.253] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0054.253] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.254] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.254] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.254] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.254] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.254] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.254] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.255] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.255] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.255] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.255] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.255] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.255] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.256] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.256] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.299] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.300] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.301] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.323] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.334] CloseHandle (hObject=0x11c) returned 1 [0054.334] CloseHandle (hObject=0x114) returned 1 [0054.335] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0054.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0054.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.336] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.336] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.336] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 1 [0054.337] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 0xffffffff [0054.337] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.337] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.337] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0054.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.338] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.338] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.338] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.338] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.338] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.338] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.338] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.338] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.338] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.338] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.339] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.339] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.339] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.339] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.397] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.398] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.399] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.422] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.433] CloseHandle (hObject=0x114) returned 1 [0054.433] CloseHandle (hObject=0x11c) returned 1 [0054.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0054.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0054.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.435] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.435] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 1 [0054.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 0xffffffff [0054.436] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.436] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.436] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="en", cAlternateFileName="")) returned 1 [0054.436] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.444] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.444] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.444] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.444] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.444] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.444] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.445] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.445] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.445] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.445] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.446] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.446] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.446] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.489] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.490] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.491] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.513] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.524] CloseHandle (hObject=0x11c) returned 1 [0054.524] CloseHandle (hObject=0x114) returned 1 [0054.525] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\6d65737361676573.json")) returned 0 [0054.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\6d65737361676573.json")) returned 0x2020 [0054.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.526] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.526] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 1 [0054.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 0xffffffff [0054.527] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.527] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.527] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0054.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.528] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.528] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.528] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.528] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.528] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.528] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.528] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.528] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.528] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.528] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.529] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.529] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.529] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.529] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.581] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.582] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.583] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.607] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.618] CloseHandle (hObject=0x114) returned 1 [0054.618] CloseHandle (hObject=0x11c) returned 1 [0054.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0054.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0054.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.620] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.620] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.620] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 1 [0054.621] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 0xffffffff [0054.621] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.622] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.622] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0054.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.623] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.623] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.623] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.623] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.623] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.623] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.624] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.624] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.624] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.624] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.624] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.624] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.625] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.669] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.670] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.670] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.693] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.705] CloseHandle (hObject=0x11c) returned 1 [0054.705] CloseHandle (hObject=0x114) returned 1 [0054.706] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0054.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0054.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.706] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.706] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.707] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 1 [0054.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0054.708] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.708] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.708] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0054.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.708] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.708] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.708] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.708] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.708] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.708] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.709] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.709] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.709] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.709] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.710] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.710] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.760] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.761] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.762] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.785] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.796] CloseHandle (hObject=0x114) returned 1 [0054.797] CloseHandle (hObject=0x11c) returned 1 [0054.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0054.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0054.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.798] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.798] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.798] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 1 [0054.799] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0054.799] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.799] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.799] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0054.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.801] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.801] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.801] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.801] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.801] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.801] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.801] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.801] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.801] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.801] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.802] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.802] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.802] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.802] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.848] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.849] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.850] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.873] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.885] CloseHandle (hObject=0x11c) returned 1 [0054.886] CloseHandle (hObject=0x114) returned 1 [0054.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0054.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0054.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.887] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.887] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.887] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 1 [0054.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0054.888] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.888] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.889] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="he", cAlternateFileName="")) returned 1 [0054.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.889] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.889] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.889] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.889] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.889] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.889] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.890] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.890] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.890] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.890] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.890] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.891] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0054.935] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0054.942] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0054.943] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.966] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.978] CloseHandle (hObject=0x114) returned 1 [0054.978] CloseHandle (hObject=0x11c) returned 1 [0054.979] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\6d65737361676573.json")) returned 0 [0054.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\6d65737361676573.json")) returned 0x2020 [0054.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0054.981] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.981] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0054.981] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 1 [0054.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 0xffffffff [0054.982] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.982] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0054.982] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0054.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0054.984] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0054.984] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.984] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0054.984] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.984] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0054.984] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0054.985] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0054.985] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0054.985] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0054.985] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0054.986] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.986] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0054.986] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.028] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.029] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.030] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.053] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.066] CloseHandle (hObject=0x11c) returned 1 [0055.067] CloseHandle (hObject=0x114) returned 1 [0055.067] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0055.068] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0055.068] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.068] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.068] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.068] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 1 [0055.069] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0055.069] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.069] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.069] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="hr", cAlternateFileName="")) returned 1 [0055.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.070] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.070] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.070] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.070] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.070] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.070] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.070] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.070] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.070] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.071] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.071] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.071] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.072] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.117] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.117] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.118] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.142] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.153] CloseHandle (hObject=0x114) returned 1 [0055.153] CloseHandle (hObject=0x11c) returned 1 [0055.154] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\6d65737361676573.json")) returned 0 [0055.155] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\6d65737361676573.json")) returned 0x2020 [0055.155] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.155] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.155] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.155] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 1 [0055.156] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0055.156] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.156] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.156] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0055.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.157] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.157] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.157] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.157] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.157] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.157] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.158] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.158] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.158] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.158] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.158] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.158] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.159] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.159] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.159] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.202] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.203] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.203] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.226] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.237] CloseHandle (hObject=0x11c) returned 1 [0055.237] CloseHandle (hObject=0x114) returned 1 [0055.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0055.239] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0055.239] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.239] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.239] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.239] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 1 [0055.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0055.240] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.240] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.240] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0055.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.241] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.241] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.241] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.241] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.241] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.241] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.241] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.241] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.241] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.241] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.242] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.242] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.284] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.285] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.286] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.309] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.320] CloseHandle (hObject=0x114) returned 1 [0055.320] CloseHandle (hObject=0x11c) returned 1 [0055.323] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0055.324] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0055.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.324] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.324] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.324] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 1 [0055.326] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 0xffffffff [0055.326] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.326] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.330] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0055.330] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.331] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.331] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.331] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.331] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.331] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.331] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.332] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.332] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.332] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.332] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.332] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.333] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.333] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.397] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.399] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.400] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.424] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.435] CloseHandle (hObject=0x11c) returned 1 [0055.435] CloseHandle (hObject=0x114) returned 1 [0055.437] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0055.438] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0055.438] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.438] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.438] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.438] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 1 [0055.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 0xffffffff [0055.439] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.439] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.439] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0055.439] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.440] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.440] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.440] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.440] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.440] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.440] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.440] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.440] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.440] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.441] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.441] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.441] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.442] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.485] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.486] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.487] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.510] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.524] CloseHandle (hObject=0x114) returned 1 [0055.524] CloseHandle (hObject=0x11c) returned 1 [0055.525] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0055.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0055.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.526] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.526] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 1 [0055.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0055.527] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.527] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.528] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0055.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.529] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.529] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.529] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.529] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.529] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.530] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.530] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.532] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.532] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.532] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.648] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.649] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.650] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.674] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.685] CloseHandle (hObject=0x11c) returned 1 [0055.685] CloseHandle (hObject=0x114) returned 1 [0055.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0055.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0055.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.687] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.687] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.687] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 1 [0055.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0055.688] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.688] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.688] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0055.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.688] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.688] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.688] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.688] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.688] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.688] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.689] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.689] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.690] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.690] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.734] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.735] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.735] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.758] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.772] CloseHandle (hObject=0x114) returned 1 [0055.772] CloseHandle (hObject=0x11c) returned 1 [0055.773] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0055.773] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0055.773] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.773] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.773] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.774] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 1 [0055.774] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0055.774] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.775] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.775] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0055.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.796] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.797] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.797] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.797] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.797] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.797] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.797] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.797] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.798] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.798] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.799] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.799] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.799] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.845] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.846] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.848] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.870] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.882] CloseHandle (hObject=0x11c) returned 1 [0055.882] CloseHandle (hObject=0x114) returned 1 [0055.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0055.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0055.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.884] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.884] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 1 [0055.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0055.886] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.886] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.886] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0055.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.886] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.886] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.886] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.886] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.886] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.886] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.887] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.887] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.887] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.887] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.888] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0055.888] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.889] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0055.932] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0055.933] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0055.934] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.957] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.970] CloseHandle (hObject=0x114) returned 1 [0055.970] CloseHandle (hObject=0x11c) returned 1 [0055.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0055.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0055.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0055.971] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.971] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0055.971] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 1 [0055.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0055.972] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.972] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0055.973] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="no", cAlternateFileName="")) returned 1 [0055.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0055.973] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0055.974] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.974] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0055.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0055.974] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0055.974] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0055.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0055.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0055.974] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0055.975] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f [0055.975] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0055.975] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.018] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x9f, lpOverlapped=0x0) returned 1 [0056.019] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xa0, lpOverlapped=0x0) returned 1 [0056.020] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.042] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.053] CloseHandle (hObject=0x11c) returned 1 [0056.054] CloseHandle (hObject=0x114) returned 1 [0056.055] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\6d65737361676573.json")) returned 0 [0056.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\6d65737361676573.json")) returned 0x2020 [0056.055] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.055] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.055] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.055] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 1 [0056.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 0xffffffff [0056.056] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.056] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.056] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0056.057] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.057] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.057] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.057] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.057] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.057] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.057] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.057] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.057] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.057] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.057] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.058] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.058] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.075] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.118] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.120] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.121] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.149] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.160] CloseHandle (hObject=0x114) returned 1 [0056.160] CloseHandle (hObject=0x11c) returned 1 [0056.161] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0056.162] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0056.162] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.162] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.162] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.162] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 1 [0056.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0056.165] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.165] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.165] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0056.165] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.166] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.166] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.167] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.167] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.167] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.167] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.167] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.167] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.168] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.168] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.168] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.211] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.212] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.213] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.237] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.249] CloseHandle (hObject=0x11c) returned 1 [0056.249] CloseHandle (hObject=0x114) returned 1 [0056.251] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0056.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0056.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.251] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.252] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.252] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 1 [0056.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0056.253] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.253] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.253] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0056.253] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.253] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.253] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.253] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.253] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.254] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.254] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.254] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.254] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.255] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.255] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.297] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.298] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.299] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.322] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.333] CloseHandle (hObject=0x114) returned 1 [0056.333] CloseHandle (hObject=0x11c) returned 1 [0056.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0056.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0056.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.335] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.335] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.335] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 1 [0056.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0056.336] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.336] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.336] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0056.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.337] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.337] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.338] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.338] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.338] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.338] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.338] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.338] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.338] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.338] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.339] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.339] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.339] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.340] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.406] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.407] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.408] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.430] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.441] CloseHandle (hObject=0x11c) returned 1 [0056.442] CloseHandle (hObject=0x114) returned 1 [0056.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0056.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0056.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.443] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.443] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.443] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 1 [0056.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0056.444] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.444] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.445] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0056.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.445] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.445] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.445] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.445] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.445] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.445] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.445] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.445] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.445] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.446] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.446] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.446] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.446] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.446] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.447] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.490] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.491] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.491] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.514] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.525] CloseHandle (hObject=0x114) returned 1 [0056.525] CloseHandle (hObject=0x11c) returned 1 [0056.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0056.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0056.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.528] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.528] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 1 [0056.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0056.529] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.529] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.529] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0056.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.536] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.536] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.536] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.536] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.536] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.536] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.537] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.537] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.537] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.537] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.538] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.538] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.583] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.584] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.585] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.608] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.620] CloseHandle (hObject=0x11c) returned 1 [0056.621] CloseHandle (hObject=0x114) returned 1 [0056.623] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0056.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0056.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.623] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.623] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.623] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 1 [0056.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0056.624] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.624] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.624] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0056.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.625] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.625] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.625] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.625] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.625] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.625] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.625] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.625] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.625] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.625] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.626] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.627] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.670] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.671] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.672] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.696] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.707] CloseHandle (hObject=0x114) returned 1 [0056.707] CloseHandle (hObject=0x11c) returned 1 [0056.708] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0056.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0056.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.709] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.709] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.709] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 1 [0056.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0056.710] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.710] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.710] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0056.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.712] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.712] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.712] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.712] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.712] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.712] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.713] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.713] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.714] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.757] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.758] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.759] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.782] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.795] CloseHandle (hObject=0x11c) returned 1 [0056.795] CloseHandle (hObject=0x114) returned 1 [0056.797] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0056.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0056.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.798] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.798] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.798] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 1 [0056.799] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0056.799] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.799] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.799] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="sv", cAlternateFileName="")) returned 1 [0056.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.799] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.799] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.800] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.800] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.800] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.800] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.800] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.800] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.800] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.800] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.800] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.801] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.801] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.801] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.857] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.858] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.859] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.883] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.894] CloseHandle (hObject=0x114) returned 1 [0056.895] CloseHandle (hObject=0x11c) returned 1 [0056.896] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\6d65737361676573.json")) returned 0 [0056.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\6d65737361676573.json")) returned 0x2020 [0056.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0056.897] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.897] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0056.897] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 1 [0056.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0056.898] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.898] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0056.899] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0056.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0056.902] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0056.902] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.902] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0056.902] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.902] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0056.903] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0056.903] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0056.903] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0056.903] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0056.903] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0056.904] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0056.904] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0056.904] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0056.950] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0056.951] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0056.953] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.976] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.999] CloseHandle (hObject=0x11c) returned 1 [0056.999] CloseHandle (hObject=0x114) returned 1 [0057.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0057.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0057.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0057.003] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.003] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0057.003] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 1 [0057.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 0xffffffff [0057.004] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.005] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0057.005] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0057.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0057.005] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0057.005] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.008] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.008] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.011] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.011] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.011] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.011] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.011] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.011] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0057.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.012] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0057.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.013] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.057] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0057.059] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0057.060] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.084] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.095] CloseHandle (hObject=0x114) returned 1 [0057.095] CloseHandle (hObject=0x11c) returned 1 [0057.096] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0057.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0057.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0057.097] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.097] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0057.097] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 1 [0057.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0057.098] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.098] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0057.098] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0057.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0057.099] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0057.099] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.099] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.099] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.099] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.099] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.099] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.099] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.099] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.100] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0057.100] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0057.100] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.101] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.144] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0057.146] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.170] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.181] CloseHandle (hObject=0x11c) returned 1 [0057.182] CloseHandle (hObject=0x114) returned 1 [0057.183] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0057.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0057.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0057.184] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.184] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0057.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 1 [0057.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0057.185] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.185] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0057.185] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0057.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0057.185] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0057.185] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.185] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.185] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.185] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.185] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.186] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.186] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.186] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.186] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0057.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.187] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0057.187] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.187] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.230] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0057.231] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0057.232] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.254] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.266] CloseHandle (hObject=0x114) returned 1 [0057.266] CloseHandle (hObject=0x11c) returned 1 [0057.267] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0057.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0057.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0057.267] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.267] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0057.268] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 1 [0057.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0057.269] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.269] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0057.269] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0057.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0057.270] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0057.270] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.270] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.270] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.270] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.270] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.270] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.271] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0057.271] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0057.271] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.272] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.314] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0057.315] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0057.316] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.339] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.350] CloseHandle (hObject=0x11c) returned 1 [0057.350] CloseHandle (hObject=0x114) returned 1 [0057.351] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0 [0057.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0x2020 [0057.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0057.352] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.352] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0057.352] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 1 [0057.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0057.353] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.353] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0057.353] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0057.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0057.354] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0057.354] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.354] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.354] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.354] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.354] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.354] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0057.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.355] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0057.355] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.355] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.410] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0057.411] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0057.412] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.434] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.445] CloseHandle (hObject=0x114) returned 1 [0057.445] CloseHandle (hObject=0x11c) returned 1 [0057.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0057.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0057.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0057.447] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.447] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0057.447] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 1 [0057.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0057.448] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.448] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0057.448] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0057.448] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0057.449] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0057.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0057.449] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0057.449] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0057.449] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.449] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.449] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.449] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.449] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.450] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.450] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.450] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0057.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.450] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2769 [0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.451] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.493] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2769, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x2769, lpOverlapped=0x0) returned 1 [0057.495] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x2770, lpOverlapped=0x0) returned 1 [0057.497] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.519] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.530] CloseHandle (hObject=0x118) returned 1 [0057.531] CloseHandle (hObject=0x11c) returned 1 [0057.533] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0057.533] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0057.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0057.533] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0057.533] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0057.534] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 1 [0057.535] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0057.535] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x11c6e6f, dwReserved1=0x31e3e0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0057.535] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0057.535] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0057.535] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0057.535] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 0 [0057.535] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0057.535] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="felcaaldnbdncclmgdcncolpebgiejap", cAlternateFileName="FELCAA~1")) returned 1 [0057.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0057.536] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0057.536] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="1.1_0", cAlternateFileName="")) returned 1 [0057.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x325098 [0057.553] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0057.553] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0057.553] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.553] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.554] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.554] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.554] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.554] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.554] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.554] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0057.558] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636f6e5f313238.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.559] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd47 [0057.559] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.559] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.639] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd47, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xd47, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xd50, lpOverlapped=0x0) returned 1 [0057.654] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.682] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.696] CloseHandle (hObject=0x110) returned 1 [0057.697] CloseHandle (hObject=0x11c) returned 1 [0057.698] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636f6e5f313238.png")) returned 0 [0057.698] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636f6e5f313238.png")) returned 0x2020 [0057.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_128.png", cAlternateFileName="")) returned 0x3250d8 [0057.698] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0057.699] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0057.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 1 [0057.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 0xffffffff [0057.700] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0057.700] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.700] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.700] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.700] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.701] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.701] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.701] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.701] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636f6e5f3136.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0057.703] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d [0057.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.703] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.758] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x9d, lpOverlapped=0x0) returned 1 [0057.760] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xa0, lpOverlapped=0x0) returned 1 [0057.761] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.791] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.806] CloseHandle (hObject=0x11c) returned 1 [0057.806] CloseHandle (hObject=0x110) returned 1 [0057.808] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636f6e5f3136.png")) returned 0 [0057.809] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\69636f6e5f3136.png")) returned 0x2020 [0057.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_16.png", cAlternateFileName="")) returned 0x3250d8 [0057.809] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0057.809] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0057.809] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 1 [0057.811] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 0xffffffff [0057.811] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0057.811] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.811] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.811] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.811] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.811] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.811] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.811] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.811] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.812] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0057.812] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d61696e.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.812] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.813] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.879] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x5c, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x60, lpOverlapped=0x0) returned 1 [0057.885] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.911] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.923] CloseHandle (hObject=0x110) returned 1 [0057.923] CloseHandle (hObject=0x11c) returned 1 [0057.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d61696e.html")) returned 0 [0057.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D61696E.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d61696e.html")) returned 0x2020 [0057.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0x3250d8 [0057.925] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0 [0057.925] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0057.925] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 1 [0057.926] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 0xffffffff [0057.926] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="main.js", cAlternateFileName="")) returned 1 [0057.926] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0057.926] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.926] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0057.926] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0057.926] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0057.926] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0057.926] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0057.927] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0057.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d61696e.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0057.927] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f [0057.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0057.928] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0057.970] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x5f, lpOverlapped=0x0) returned 1 [0057.971] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x60, lpOverlapped=0x0) returned 1 [0057.972] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.995] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.006] CloseHandle (hObject=0x11c) returned 1 [0058.006] CloseHandle (hObject=0x110) returned 1 [0058.007] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d61696e.js")) returned 0 [0058.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D61696E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d61696e.js")) returned 0x2020 [0058.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.js", cAlternateFileName="")) returned 0x3250d8 [0058.007] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="main.js", cAlternateFileName="")) returned 0 [0058.007] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0058.008] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 1 [0058.008] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 0xffffffff [0058.009] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0058.009] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.009] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.009] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.009] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.009] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.009] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.009] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.009] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0058.010] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0058.010] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d6 [0058.010] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.010] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.053] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x2d6, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x2e0, lpOverlapped=0x0) returned 1 [0058.066] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.089] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.099] CloseHandle (hObject=0x110) returned 1 [0058.100] CloseHandle (hObject=0x11c) returned 1 [0058.101] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d616e6966657374.json")) returned 0 [0058.101] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\6d616e6966657374.json")) returned 0x2020 [0058.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0058.101] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0058.101] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0058.101] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 1 [0058.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 0xffffffff [0058.103] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0058.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0058.104] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0058.104] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName="ar", cAlternateFileName="")) returned 1 [0058.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.105] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0058.105] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.105] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.105] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.105] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.105] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.105] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.105] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.105] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.105] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.107] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0058.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.107] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.149] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfe, lpOverlapped=0x0) returned 1 [0058.150] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0058.151] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.174] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.185] CloseHandle (hObject=0x118) returned 1 [0058.185] CloseHandle (hObject=0x114) returned 1 [0058.186] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\6d65737361676573.json")) returned 0 [0058.187] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\6d65737361676573.json")) returned 0x2020 [0058.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.187] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.187] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.187] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 1 [0058.188] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0058.188] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.188] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.188] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0058.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.189] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.189] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.189] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.189] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.189] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.189] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.189] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.189] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.189] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.189] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.189] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.190] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f [0058.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.190] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.234] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x12f, lpOverlapped=0x0) returned 1 [0058.234] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0058.235] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.265] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.276] CloseHandle (hObject=0x114) returned 1 [0058.277] CloseHandle (hObject=0x118) returned 1 [0058.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0058.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0058.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.278] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.278] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.279] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 1 [0058.280] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0058.280] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.280] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.280] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0058.280] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.280] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.281] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.281] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.281] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.281] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.281] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.281] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.281] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.281] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.281] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.283] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0058.283] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.283] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.326] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe5, lpOverlapped=0x0) returned 1 [0058.327] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0058.328] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.350] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.362] CloseHandle (hObject=0x118) returned 1 [0058.362] CloseHandle (hObject=0x114) returned 1 [0058.363] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0058.363] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0058.363] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.363] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.363] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.364] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 1 [0058.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0058.365] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.365] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.365] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0058.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.365] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.365] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.365] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.365] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.365] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.365] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.366] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.366] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.366] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.366] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.366] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0058.366] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.367] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.426] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xda, lpOverlapped=0x0) returned 1 [0058.427] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0058.428] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.450] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.461] CloseHandle (hObject=0x114) returned 1 [0058.461] CloseHandle (hObject=0x118) returned 1 [0058.463] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0058.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0058.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.464] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.464] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.464] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 1 [0058.465] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0058.465] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.465] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.465] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0058.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.465] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.466] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.466] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.466] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.466] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.466] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.466] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.466] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.466] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.466] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.469] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0058.469] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.470] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.514] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xcf, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0058.515] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.538] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.549] CloseHandle (hObject=0x118) returned 1 [0058.550] CloseHandle (hObject=0x114) returned 1 [0058.551] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0058.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0058.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.551] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.551] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.551] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 1 [0058.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0058.552] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.552] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.553] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0058.553] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.553] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.553] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.553] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.553] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.553] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.553] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.553] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.553] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.553] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.554] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.555] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc [0058.555] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.556] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.599] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdc, lpOverlapped=0x0) returned 1 [0058.601] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0058.602] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.624] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.635] CloseHandle (hObject=0x114) returned 1 [0058.636] CloseHandle (hObject=0x118) returned 1 [0058.637] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0058.637] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0058.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.637] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.637] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.637] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 1 [0058.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0058.638] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.638] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.638] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0058.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.639] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.639] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.639] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.639] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.639] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.639] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.639] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.639] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.639] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.639] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.641] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130 [0058.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.641] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.684] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0058.685] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x140, lpOverlapped=0x0) returned 1 [0058.686] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.708] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.719] CloseHandle (hObject=0x118) returned 1 [0058.720] CloseHandle (hObject=0x114) returned 1 [0058.721] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0058.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0058.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.722] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.722] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.722] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 1 [0058.723] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0058.723] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.723] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.723] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0058.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.724] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.724] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.724] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.724] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.724] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.724] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.724] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.724] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.724] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.724] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.725] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0058.725] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.725] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.768] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd5, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0058.770] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.793] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.804] CloseHandle (hObject=0x114) returned 1 [0058.804] CloseHandle (hObject=0x118) returned 1 [0058.806] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0 [0058.806] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0x2020 [0058.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.807] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.807] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.807] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0058.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0058.808] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.808] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.808] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="en_US", cAlternateFileName="")) returned 1 [0058.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.808] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.808] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.808] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.808] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.808] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.808] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.809] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.809] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.809] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.809] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.809] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.810] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0058.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.811] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.867] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd5, lpOverlapped=0x0) returned 1 [0058.868] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0058.869] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.891] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.903] CloseHandle (hObject=0x118) returned 1 [0058.903] CloseHandle (hObject=0x114) returned 1 [0058.906] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\6d65737361676573.json")) returned 0 [0058.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\6d65737361676573.json")) returned 0x2020 [0058.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.907] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.907] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.907] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 1 [0058.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0058.908] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.908] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.908] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0058.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.909] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.909] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.909] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.909] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.909] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.909] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0058.909] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0058.909] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.909] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0058.909] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0058.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0058.910] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0058.910] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0058.910] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0058.960] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe5, lpOverlapped=0x0) returned 1 [0058.961] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0058.962] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.985] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.996] CloseHandle (hObject=0x114) returned 1 [0058.996] CloseHandle (hObject=0x118) returned 1 [0058.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0058.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0058.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0058.998] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.998] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0058.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 1 [0058.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0058.999] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.999] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0058.999] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="es_419", cAlternateFileName="")) returned 1 [0058.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0058.999] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0058.999] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.999] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0058.999] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0058.999] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0058.999] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.000] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.000] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.002] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0059.002] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.002] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.045] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe5, lpOverlapped=0x0) returned 1 [0059.046] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0059.047] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.070] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.081] CloseHandle (hObject=0x118) returned 1 [0059.081] CloseHandle (hObject=0x114) returned 1 [0059.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\6d65737361676573.json")) returned 0 [0059.082] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\6d65737361676573.json")) returned 0x2020 [0059.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.082] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.082] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.083] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 1 [0059.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0059.084] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.084] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.084] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="et", cAlternateFileName="")) returned 1 [0059.084] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.084] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.084] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.084] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.084] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.084] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.084] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.088] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.088] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.089] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0059.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.089] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.140] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe2, lpOverlapped=0x0) returned 1 [0059.141] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0059.142] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.165] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.175] CloseHandle (hObject=0x114) returned 1 [0059.176] CloseHandle (hObject=0x118) returned 1 [0059.177] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\6d65737361676573.json")) returned 0 [0059.177] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\6d65737361676573.json")) returned 0x2020 [0059.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.177] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.177] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.177] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 1 [0059.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 0xffffffff [0059.178] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.180] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.180] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0059.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.180] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.180] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.180] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.180] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.180] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.180] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.181] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.181] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.181] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.181] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.181] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.182] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc [0059.182] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.182] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.228] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdc, lpOverlapped=0x0) returned 1 [0059.229] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0059.230] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.252] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.263] CloseHandle (hObject=0x118) returned 1 [0059.263] CloseHandle (hObject=0x114) returned 1 [0059.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0059.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0059.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.265] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.265] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 1 [0059.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0059.266] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.266] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.266] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0059.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.267] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.267] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.267] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.267] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.267] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.267] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.267] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.267] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.267] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.267] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.268] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0059.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.268] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.320] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdf, lpOverlapped=0x0) returned 1 [0059.321] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0059.322] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.345] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.356] CloseHandle (hObject=0x114) returned 1 [0059.356] CloseHandle (hObject=0x118) returned 1 [0059.357] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0059.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0059.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.359] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.359] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.359] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 1 [0059.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0059.360] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.360] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.360] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0059.360] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.360] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.360] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.361] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.361] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.361] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.361] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.361] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.361] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.362] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.362] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.362] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.363] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0059.363] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.364] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.420] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe2, lpOverlapped=0x0) returned 1 [0059.421] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0059.422] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.445] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.456] CloseHandle (hObject=0x118) returned 1 [0059.456] CloseHandle (hObject=0x114) returned 1 [0059.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0059.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0059.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.459] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.459] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.459] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 1 [0059.461] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0059.461] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.461] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.461] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="he", cAlternateFileName="")) returned 1 [0059.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.461] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.461] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.461] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.461] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.462] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.462] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.463] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee [0059.463] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.463] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.511] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xee, lpOverlapped=0x0) returned 1 [0059.511] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0059.512] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.535] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.546] CloseHandle (hObject=0x114) returned 1 [0059.546] CloseHandle (hObject=0x118) returned 1 [0059.547] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\6d65737361676573.json")) returned 0 [0059.548] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\6d65737361676573.json")) returned 0x2020 [0059.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.548] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.548] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.548] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 1 [0059.549] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 0xffffffff [0059.549] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.549] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.549] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0059.549] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.550] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.550] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.550] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.550] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.550] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.550] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.550] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.550] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.550] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.550] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.551] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.552] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0059.552] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.552] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.649] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x11a, lpOverlapped=0x0) returned 1 [0059.650] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0059.651] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.674] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.686] CloseHandle (hObject=0x118) returned 1 [0059.686] CloseHandle (hObject=0x114) returned 1 [0059.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0059.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0059.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.688] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.688] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 1 [0059.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0059.689] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.689] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.689] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0059.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.690] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.690] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.690] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.690] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.690] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.690] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.691] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0059.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.691] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.745] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xeb, lpOverlapped=0x0) returned 1 [0059.746] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0059.748] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.770] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.783] CloseHandle (hObject=0x114) returned 1 [0059.783] CloseHandle (hObject=0x118) returned 1 [0059.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0059.788] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0059.788] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.788] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.788] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.789] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 1 [0059.790] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0059.790] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.790] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.790] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0059.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.790] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.790] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.790] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.790] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.791] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.791] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.791] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.791] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.791] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.791] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.791] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.799] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0059.799] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.799] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.850] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd8, lpOverlapped=0x0) returned 1 [0059.851] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0059.854] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.876] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.887] CloseHandle (hObject=0x118) returned 1 [0059.887] CloseHandle (hObject=0x114) returned 1 [0059.888] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0059.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0059.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.889] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.889] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.889] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 1 [0059.890] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0059.890] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.890] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.890] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0059.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.891] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.891] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.891] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.891] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.891] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.892] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0059.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.892] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0059.892] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0059.893] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0059.956] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd7, lpOverlapped=0x0) returned 1 [0059.957] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0059.958] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.982] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.993] CloseHandle (hObject=0x114) returned 1 [0059.993] CloseHandle (hObject=0x118) returned 1 [0059.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0059.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0059.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0059.995] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.995] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0059.995] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 1 [0059.996] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0059.996] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.996] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0059.996] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0059.996] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0059.996] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0059.997] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.997] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0059.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0059.997] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0059.997] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0059.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0059.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0059.997] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0059.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.000] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf5 [0060.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.000] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.064] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf5, lpOverlapped=0x0) returned 1 [0060.065] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0060.066] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.090] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.102] CloseHandle (hObject=0x118) returned 1 [0060.102] CloseHandle (hObject=0x114) returned 1 [0060.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0060.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0060.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.104] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.104] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.104] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 1 [0060.105] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0060.105] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.105] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.105] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0060.105] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.105] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.105] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.106] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.106] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.106] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.106] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.106] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.106] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.106] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.106] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.107] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0060.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.107] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.166] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0060.168] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0060.169] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.198] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.212] CloseHandle (hObject=0x114) returned 1 [0060.213] CloseHandle (hObject=0x118) returned 1 [0060.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0060.214] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0060.214] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.214] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.214] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.214] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 1 [0060.215] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0060.215] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.215] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.216] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0060.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.216] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.216] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.216] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.216] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.216] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.216] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.217] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.217] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.217] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.217] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.217] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.227] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0060.227] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.227] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.278] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xeb, lpOverlapped=0x0) returned 1 [0060.280] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0060.281] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.304] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.315] CloseHandle (hObject=0x118) returned 1 [0060.316] CloseHandle (hObject=0x114) returned 1 [0060.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0060.318] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0060.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.318] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.318] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.318] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 1 [0060.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0060.319] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.319] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.319] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0060.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.320] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.320] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.320] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.320] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.320] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.320] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.321] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.321] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.321] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.321] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.322] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0060.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.322] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.398] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe5, lpOverlapped=0x0) returned 1 [0060.400] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0060.401] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.427] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.438] CloseHandle (hObject=0x114) returned 1 [0060.438] CloseHandle (hObject=0x118) returned 1 [0060.440] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0060.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0060.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.441] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.441] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.441] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 1 [0060.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0060.442] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.442] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.443] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ms", cAlternateFileName="")) returned 1 [0060.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.443] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.443] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.443] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.443] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.443] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.443] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.444] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.444] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.444] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.444] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.444] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.446] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0060.446] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.446] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.495] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0060.495] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0060.496] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.520] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.531] CloseHandle (hObject=0x118) returned 1 [0060.531] CloseHandle (hObject=0x114) returned 1 [0060.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\6d65737361676573.json")) returned 0 [0060.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\6d65737361676573.json")) returned 0x2020 [0060.532] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.533] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.533] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.533] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 1 [0060.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0060.534] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.534] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.534] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0060.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.534] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.534] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.534] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.534] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.534] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.534] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.535] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.535] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.535] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.535] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.536] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0060.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.536] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.585] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0060.586] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0060.587] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.610] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.621] CloseHandle (hObject=0x114) returned 1 [0060.621] CloseHandle (hObject=0x118) returned 1 [0060.622] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0060.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0060.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.623] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.623] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.623] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 1 [0060.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0060.624] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.624] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.624] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="no", cAlternateFileName="")) returned 1 [0060.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.625] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.625] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.625] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.625] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.625] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.625] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.626] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.626] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.626] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.626] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.630] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbf [0060.630] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.630] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.681] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xbf, lpOverlapped=0x0) returned 1 [0060.682] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0060.683] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.706] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.717] CloseHandle (hObject=0x118) returned 1 [0060.718] CloseHandle (hObject=0x114) returned 1 [0060.718] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\6d65737361676573.json")) returned 0 [0060.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\6d65737361676573.json")) returned 0x2020 [0060.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.719] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.719] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.719] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 1 [0060.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0060.720] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.720] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.720] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0060.720] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.721] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.721] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.721] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.721] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.721] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.721] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.721] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.721] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.721] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.721] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.722] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0060.722] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.722] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.781] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd1, lpOverlapped=0x0) returned 1 [0060.782] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0060.783] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.806] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.817] CloseHandle (hObject=0x114) returned 1 [0060.818] CloseHandle (hObject=0x118) returned 1 [0060.819] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0060.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0060.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.819] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.819] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 1 [0060.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0060.820] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.820] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.821] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0060.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.821] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.821] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.821] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.821] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.821] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.821] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.822] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.822] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.822] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.822] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.825] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0060.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.825] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0060.921] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd5, lpOverlapped=0x0) returned 1 [0060.922] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0060.923] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.962] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.974] CloseHandle (hObject=0x118) returned 1 [0060.974] CloseHandle (hObject=0x114) returned 1 [0060.975] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0060.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0060.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0060.976] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.976] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0060.976] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0060.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0060.977] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.977] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0060.980] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0060.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0060.981] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0060.981] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.981] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0060.981] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.981] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0060.981] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0060.981] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0060.981] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0060.981] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0060.982] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0060.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0060.982] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0060.982] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0060.982] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0061.081] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe6, lpOverlapped=0x0) returned 1 [0061.082] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0061.083] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.108] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.120] CloseHandle (hObject=0x114) returned 1 [0061.120] CloseHandle (hObject=0x118) returned 1 [0061.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0061.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0061.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0061.122] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.122] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0061.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0061.123] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0061.123] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.123] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0061.124] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0061.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0061.124] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0061.124] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.124] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0061.124] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.124] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0061.124] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0061.125] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0061.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0061.125] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0061.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0061.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0061.126] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0061.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0061.127] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0061.216] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe2, lpOverlapped=0x0) returned 1 [0061.218] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0061.219] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.244] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.257] CloseHandle (hObject=0x118) returned 1 [0061.257] CloseHandle (hObject=0x114) returned 1 [0061.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0061.258] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0061.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0061.259] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.259] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0061.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 1 [0061.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0061.260] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.260] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0061.260] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0061.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0061.261] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0061.261] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.261] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0061.261] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.261] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0061.261] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0061.261] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0061.261] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.261] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0061.261] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0061.262] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0061.262] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0061.262] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0061.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0061.263] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0061.356] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfe, lpOverlapped=0x0) returned 1 [0061.357] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0061.358] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.402] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.420] CloseHandle (hObject=0x114) returned 1 [0061.420] CloseHandle (hObject=0x118) returned 1 [0061.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0061.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0061.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0061.422] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.422] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0061.422] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 1 [0061.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0061.423] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.423] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0061.423] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0061.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0061.424] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0061.424] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.424] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0061.424] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.424] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0061.424] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0061.425] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0061.425] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.425] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0061.425] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0061.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0061.426] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0061.426] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb [0061.426] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0061.427] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0061.506] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdb, lpOverlapped=0x0) returned 1 [0061.507] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0061.507] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.530] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.541] CloseHandle (hObject=0x118) returned 1 [0061.542] CloseHandle (hObject=0x114) returned 1 [0061.543] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0061.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0061.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0061.544] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.544] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0061.544] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 1 [0061.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0061.545] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.545] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0061.545] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0061.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0061.545] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0061.546] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.546] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0061.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0061.546] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0061.546] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0061.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0061.546] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0061.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0061.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0061.547] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0061.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0061.547] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0061.684] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xde, lpOverlapped=0x0) returned 1 [0061.684] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0061.685] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.708] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.719] CloseHandle (hObject=0x114) returned 1 [0061.719] CloseHandle (hObject=0x118) returned 1 [0061.720] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0061.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0061.720] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0061.721] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.721] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0061.721] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 1 [0061.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0061.722] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.722] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0061.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0061.723] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.723] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0061.723] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.723] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0061.723] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0061.723] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0061.723] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.723] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0061.724] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0061.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0061.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0061.725] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0061.725] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0061.725] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0061.817] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xec, lpOverlapped=0x0) returned 1 [0061.818] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0061.819] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.842] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.869] CloseHandle (hObject=0x118) returned 1 [0061.870] CloseHandle (hObject=0x114) returned 1 [0061.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0061.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0061.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0061.876] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.876] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0061.877] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 1 [0061.878] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0061.878] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.878] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0061.878] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sv", cAlternateFileName="")) returned 1 [0061.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0061.878] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0061.879] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.881] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0061.881] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.884] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0061.884] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0061.884] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0061.884] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0061.884] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0061.884] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0061.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0061.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0061.885] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0061.885] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0061.886] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0061.987] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd8, lpOverlapped=0x0) returned 1 [0061.988] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0061.989] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.023] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.035] CloseHandle (hObject=0x114) returned 1 [0062.035] CloseHandle (hObject=0x118) returned 1 [0062.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\6d65737361676573.json")) returned 0 [0062.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\6d65737361676573.json")) returned 0x2020 [0062.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0062.036] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.036] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0062.037] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 1 [0062.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0062.038] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.038] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0062.038] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0062.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0062.038] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0062.038] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.038] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0062.038] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.038] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0062.038] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0062.039] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0062.039] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.039] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0062.039] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0062.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0062.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0062.040] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a [0062.040] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0062.041] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0062.118] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10a, lpOverlapped=0x0) returned 1 [0062.119] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0062.120] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.143] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.154] CloseHandle (hObject=0x118) returned 1 [0062.154] CloseHandle (hObject=0x114) returned 1 [0062.156] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0062.156] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0062.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0062.156] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.156] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0062.157] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 1 [0062.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0062.158] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.158] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0062.158] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0062.158] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0062.159] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0062.159] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.159] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0062.159] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.159] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0062.159] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0062.159] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0062.159] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.159] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0062.160] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0062.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0062.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0062.160] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0062.160] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0062.161] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0062.273] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe1, lpOverlapped=0x0) returned 1 [0062.274] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0062.274] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.297] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.309] CloseHandle (hObject=0x114) returned 1 [0062.309] CloseHandle (hObject=0x118) returned 1 [0062.310] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0062.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0062.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0062.310] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.310] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0062.311] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 1 [0062.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0062.312] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.312] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0062.312] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0062.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0062.312] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0062.312] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.312] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0062.312] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.312] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0062.312] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0062.313] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0062.313] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.313] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0062.313] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0062.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0062.314] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0062.314] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0062.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0062.315] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0062.415] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfe, lpOverlapped=0x0) returned 1 [0062.415] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0062.416] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.447] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.458] CloseHandle (hObject=0x118) returned 1 [0062.458] CloseHandle (hObject=0x114) returned 1 [0062.459] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0062.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0062.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0062.460] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.460] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0062.460] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 1 [0062.461] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0062.461] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.461] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0062.461] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0062.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0062.461] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0062.461] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.462] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0062.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0062.462] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0062.462] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0062.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0062.462] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0062.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0062.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0062.463] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0062.463] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0062.463] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0062.555] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe3, lpOverlapped=0x0) returned 1 [0062.556] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0062.557] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.580] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.591] CloseHandle (hObject=0x114) returned 1 [0062.591] CloseHandle (hObject=0x118) returned 1 [0062.592] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0062.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0062.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0062.593] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.593] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0062.593] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 1 [0062.594] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0062.594] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.594] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0062.594] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0062.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0062.594] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0062.594] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.594] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0062.595] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.595] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0062.595] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0062.595] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0062.595] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.595] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0062.595] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0062.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0062.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0062.596] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0062.596] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0062.596] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0062.679] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd4, lpOverlapped=0x0) returned 1 [0062.680] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0062.681] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.704] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.715] CloseHandle (hObject=0x118) returned 1 [0062.715] CloseHandle (hObject=0x114) returned 1 [0062.716] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0 [0062.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0x2020 [0062.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0062.716] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.717] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0062.717] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0062.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0062.718] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.718] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0062.718] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0062.718] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0062.718] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0062.718] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.718] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0062.718] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.718] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0062.718] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0062.719] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0062.719] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.719] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0062.719] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0062.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0062.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0062.720] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0062.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0062.720] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0062.811] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd4, lpOverlapped=0x0) returned 1 [0062.812] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0062.813] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.837] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.848] CloseHandle (hObject=0x114) returned 1 [0062.848] CloseHandle (hObject=0x118) returned 1 [0062.849] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0062.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0062.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0062.850] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.850] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0062.850] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0062.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0062.851] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.851] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0062.851] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0062.851] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0062.851] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0062.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0062.852] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0062.852] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0062.852] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0062.852] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.852] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0062.852] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0062.852] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0062.852] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.852] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0062.852] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0062.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0062.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\636f6d70757465645f686173686573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0062.855] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0062.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0062.855] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0062.948] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x160, lpOverlapped=0x0) returned 1 [0062.949] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x170, lpOverlapped=0x0) returned 1 [0062.950] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.973] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.984] CloseHandle (hObject=0x110) returned 1 [0062.984] CloseHandle (hObject=0x118) returned 1 [0062.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0 [0062.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0x2020 [0062.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x325118 [0062.986] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0062.986] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0062.986] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 1 [0062.987] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0062.987] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0062.987] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0062.987] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.987] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0062.987] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0062.988] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0062.988] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0062.988] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0062.988] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0062.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0062.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0062.989] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0062.989] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0062.989] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0063.092] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x2b56, lpOverlapped=0x0) returned 1 [0063.101] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x2b60, lpOverlapped=0x0) returned 1 [0063.102] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.125] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.136] CloseHandle (hObject=0x118) returned 1 [0063.136] CloseHandle (hObject=0x110) returned 1 [0063.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0063.138] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0063.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0063.138] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0063.138] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0063.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 1 [0063.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0063.140] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0063.140] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0063.140] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0063.140] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0063.141] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="1.1_0", cAlternateFileName="")) returned 0 [0063.141] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0063.141] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0063.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0063.142] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0063.142] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="1.4_0", cAlternateFileName="")) returned 1 [0063.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x325098 [0063.144] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0063.144] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0063.144] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0063.144] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.144] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0063.144] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0063.145] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0063.145] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.145] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0063.145] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0063.145] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.145] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\313238.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0063.146] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1378 [0063.146] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0063.146] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0063.222] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x1378, lpOverlapped=0x0) returned 1 [0063.226] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x1380, lpOverlapped=0x0) returned 1 [0063.227] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.249] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.262] CloseHandle (hObject=0x11c) returned 1 [0063.263] CloseHandle (hObject=0x110) returned 1 [0063.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\313238.png")) returned 0 [0063.264] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\313238.png")) returned 0x2020 [0063.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="128.png", cAlternateFileName="")) returned 0x3250d8 [0063.264] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="128.png", cAlternateFileName="")) returned 0 [0063.264] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0063.264] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 1 [0063.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 0xffffffff [0063.265] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 1 [0063.266] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0063.266] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.266] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0063.266] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0063.266] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0063.266] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.266] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0063.266] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0063.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0063.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\636F6E74656E747363726970745F62696E5F70726F64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\636f6e74656e747363726970745f62696e5f70726f64.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.268] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1103 [0063.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0063.268] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0063.407] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x1103, lpOverlapped=0x0) returned 1 [0063.409] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x1110, lpOverlapped=0x0) returned 1 [0063.410] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.432] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.444] CloseHandle (hObject=0x110) returned 1 [0063.444] CloseHandle (hObject=0x11c) returned 1 [0063.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\636F6E74656E747363726970745F62696E5F70726F64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\636f6e74656e747363726970745f62696e5f70726f64.js")) returned 0 [0063.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\636F6E74656E747363726970745F62696E5F70726F64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\636f6e74656e747363726970745f62696e5f70726f64.js")) returned 0x2020 [0063.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 0x3250d8 [0063.446] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 0 [0063.446] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0063.446] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 1 [0063.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 0xffffffff [0063.447] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 1 [0063.447] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0063.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0063.447] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0063.447] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0063.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0063.448] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0063.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\64617368657253657474696E67536368656D61.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\64617368657253657474696e67536368656d61.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0063.448] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x356 [0063.448] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0063.449] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0063.535] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x356, lpOverlapped=0x0) returned 1 [0063.543] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x360, lpOverlapped=0x0) returned 1 [0063.544] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.567] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.577] CloseHandle (hObject=0x11c) returned 1 [0063.609] CloseHandle (hObject=0x110) returned 1 [0063.613] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\64617368657253657474696E67536368656D61.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\64617368657253657474696e67536368656d61.json")) returned 0 [0063.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\64617368657253657474696E67536368656D61.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\64617368657253657474696e67536368656d61.json")) returned 0x2020 [0063.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 0x3250d8 [0063.614] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 0 [0063.614] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0063.614] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 1 [0063.615] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 0xffffffff [0063.615] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 1 [0063.616] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0063.616] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.616] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0063.616] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0063.616] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0063.616] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.616] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0063.616] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0063.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0063.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6576656E74706167655F62696E5F70726F64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6576656e74706167655f62696e5f70726f64.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.617] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b6c [0063.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0063.617] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0063.710] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5b6c, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x5b6c, lpOverlapped=0x0) returned 1 [0063.713] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x5b70, lpOverlapped=0x0) returned 1 [0063.714] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.737] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.748] CloseHandle (hObject=0x110) returned 1 [0063.749] CloseHandle (hObject=0x11c) returned 1 [0063.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6576656E74706167655F62696E5F70726F64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6576656e74706167655f62696e5f70726f64.js")) returned 0 [0063.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6576656E74706167655F62696E5F70726F64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6576656e74706167655f62696e5f70726f64.js")) returned 0x2020 [0063.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 0x3250d8 [0063.751] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 0 [0063.751] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0063.751] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 1 [0063.752] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 0xffffffff [0063.752] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0063.752] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0063.752] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.752] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0063.752] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0063.753] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0063.753] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.753] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0063.753] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0063.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0063.754] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b1 [0063.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0063.754] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0063.846] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x5b1, lpOverlapped=0x0) returned 1 [0063.848] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x5c0, lpOverlapped=0x0) returned 1 [0063.849] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.872] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.883] CloseHandle (hObject=0x11c) returned 1 [0063.883] CloseHandle (hObject=0x110) returned 1 [0063.884] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6d616e6966657374.json")) returned 0 [0063.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\6d616e6966657374.json")) returned 0x2020 [0063.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0063.885] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0063.885] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0063.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 1 [0063.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 0xffffffff [0063.886] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 1 [0063.886] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0063.886] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.886] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0063.886] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0063.887] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0063.887] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0063.887] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0063.887] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0063.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0063.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\706167655F656D6265645F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\706167655f656d6265645f736372697074.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.888] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0063.888] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0063.888] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0063.982] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xe0, lpOverlapped=0x0) returned 1 [0063.983] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xf0, lpOverlapped=0x0) returned 1 [0063.984] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.007] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.018] CloseHandle (hObject=0x110) returned 1 [0064.019] CloseHandle (hObject=0x11c) returned 1 [0064.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\706167655F656D6265645F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\706167655f656d6265645f736372697074.js")) returned 0 [0064.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\706167655F656D6265645F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\706167655f656d6265645f736372697074.js")) returned 0x2020 [0064.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 0x3250d8 [0064.020] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 0 [0064.020] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0064.020] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 1 [0064.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 0xffffffff [0064.021] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0064.021] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1260124, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0064.023] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1260124, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0064.024] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1260124, dwReserved1=0x31e3e0, cFileName="af", cAlternateFileName="")) returned 1 [0064.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0064.024] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0064.024] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.025] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0064.025] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.025] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0064.025] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0064.025] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0064.025] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.025] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0064.025] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0064.026] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0064.026] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84 [0064.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0064.026] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0064.121] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x84, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x84, lpOverlapped=0x0) returned 1 [0064.122] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x90, lpOverlapped=0x0) returned 1 [0064.123] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.146] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.157] CloseHandle (hObject=0x118) returned 1 [0064.157] CloseHandle (hObject=0x114) returned 1 [0064.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\6d65737361676573.json")) returned 0 [0064.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\6d65737361676573.json")) returned 0x2020 [0064.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0064.159] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.159] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0064.160] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 1 [0064.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 0xffffffff [0064.161] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.161] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0064.161] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="am", cAlternateFileName="")) returned 1 [0064.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0064.161] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0064.161] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.161] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0064.161] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.162] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0064.162] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0064.162] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0064.162] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.162] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0064.162] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0064.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0064.163] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0064.163] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0064.163] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0064.257] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x103, lpOverlapped=0x0) returned 1 [0064.258] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0064.259] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.282] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.293] CloseHandle (hObject=0x114) returned 1 [0064.293] CloseHandle (hObject=0x118) returned 1 [0064.294] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\6d65737361676573.json")) returned 0 [0064.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\6d65737361676573.json")) returned 0x2020 [0064.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0064.295] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.295] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0064.295] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 1 [0064.296] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 0xffffffff [0064.296] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.296] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0064.296] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ar", cAlternateFileName="")) returned 1 [0064.296] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0064.297] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0064.297] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.297] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0064.297] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.297] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0064.297] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0064.298] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0064.298] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.298] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0064.298] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.298] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0064.298] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0064.299] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0064.299] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0064.299] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0064.411] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xed, lpOverlapped=0x0) returned 1 [0064.412] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0064.413] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.435] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.447] CloseHandle (hObject=0x118) returned 1 [0064.447] CloseHandle (hObject=0x114) returned 1 [0064.448] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\6d65737361676573.json")) returned 0 [0064.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\6d65737361676573.json")) returned 0x2020 [0064.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0064.449] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.449] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0064.449] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 1 [0064.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0064.450] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.450] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0064.450] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="az", cAlternateFileName="")) returned 1 [0064.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0064.451] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0064.451] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.451] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0064.451] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.451] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0064.451] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0064.452] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0064.452] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.452] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0064.452] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.452] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0064.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0064.453] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7 [0064.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0064.453] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0064.531] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xa7, lpOverlapped=0x0) returned 1 [0064.533] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xb0, lpOverlapped=0x0) returned 1 [0064.533] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.556] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.587] CloseHandle (hObject=0x114) returned 1 [0064.587] CloseHandle (hObject=0x118) returned 1 [0064.588] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\6d65737361676573.json")) returned 0 [0064.589] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\6d65737361676573.json")) returned 0x2020 [0064.589] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0064.589] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.589] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0064.589] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 1 [0064.590] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 0xffffffff [0064.590] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.590] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0064.590] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0064.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0064.600] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0064.600] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.600] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0064.600] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.600] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0064.600] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0064.601] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0064.601] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.601] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0064.601] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0064.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0064.602] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114 [0064.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0064.603] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0064.680] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x114, lpOverlapped=0x0) returned 1 [0064.682] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0064.683] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.706] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.718] CloseHandle (hObject=0x118) returned 1 [0064.718] CloseHandle (hObject=0x114) returned 1 [0064.719] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0064.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0064.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0064.720] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.720] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0064.720] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 1 [0064.721] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0064.721] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.721] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0064.721] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="bn", cAlternateFileName="")) returned 1 [0064.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0064.721] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0064.721] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.721] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0064.722] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.722] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0064.722] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0064.722] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0064.722] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.722] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0064.722] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0064.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0064.723] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14b [0064.723] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0064.723] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0064.847] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x14b, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x150, lpOverlapped=0x0) returned 1 [0064.849] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.872] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.883] CloseHandle (hObject=0x114) returned 1 [0064.883] CloseHandle (hObject=0x118) returned 1 [0064.884] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\6d65737361676573.json")) returned 0 [0064.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\6d65737361676573.json")) returned 0x2020 [0064.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0064.885] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.885] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0064.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 1 [0064.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 0xffffffff [0064.886] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.886] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0064.886] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0064.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0064.922] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0064.922] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.923] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0064.923] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.923] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0064.923] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0064.923] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0064.923] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0064.923] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0064.923] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0064.924] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0064.924] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0064.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0064.925] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0065.111] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xcf, lpOverlapped=0x0) returned 1 [0065.112] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0065.113] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.137] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.148] CloseHandle (hObject=0x118) returned 1 [0065.149] CloseHandle (hObject=0x114) returned 1 [0065.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0065.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0065.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0065.150] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.150] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0065.150] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 1 [0065.151] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0065.151] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.151] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0065.152] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0065.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0065.152] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0065.152] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.152] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0065.152] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0065.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0065.152] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0065.153] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0065.153] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0065.153] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0065.153] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0065.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0065.201] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0065.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0065.201] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0065.390] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xad, lpOverlapped=0x0) returned 1 [0065.391] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xb0, lpOverlapped=0x0) returned 1 [0065.392] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.415] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.426] CloseHandle (hObject=0x114) returned 1 [0065.426] CloseHandle (hObject=0x118) returned 1 [0065.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0065.427] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0065.428] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0065.428] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.428] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0065.428] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 1 [0065.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0065.429] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.429] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0065.429] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0065.429] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0065.466] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0065.466] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.466] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0065.466] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0065.466] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0065.466] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0065.467] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0065.467] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0065.467] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0065.467] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.467] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0065.467] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0065.468] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac [0065.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0065.468] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0065.597] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xac, lpOverlapped=0x0) returned 1 [0065.665] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xb0, lpOverlapped=0x0) returned 1 [0065.666] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.691] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.750] CloseHandle (hObject=0x118) returned 1 [0065.750] CloseHandle (hObject=0x114) returned 1 [0065.752] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0065.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0065.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0065.753] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.753] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0065.753] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 1 [0065.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 0xffffffff [0065.755] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.755] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0065.755] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0065.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0065.756] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0065.756] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.756] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0065.756] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0065.756] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0065.756] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0065.757] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0065.757] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0065.757] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0065.757] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0065.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0065.761] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc1 [0065.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0065.761] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0065.934] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc1, lpOverlapped=0x0) returned 1 [0065.935] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0065.936] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.959] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.017] CloseHandle (hObject=0x114) returned 1 [0066.017] CloseHandle (hObject=0x118) returned 1 [0066.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0066.018] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0066.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0066.018] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.019] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0066.019] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 1 [0066.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 0xffffffff [0066.020] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.020] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0066.020] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0066.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0066.059] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0066.059] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.059] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0066.059] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.059] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0066.059] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0066.059] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0066.059] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.059] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0066.059] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0066.060] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0066.060] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0066.060] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12a [0066.060] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0066.061] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0066.248] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x12a, lpOverlapped=0x0) returned 1 [0066.250] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0066.251] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.273] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.285] CloseHandle (hObject=0x118) returned 1 [0066.285] CloseHandle (hObject=0x114) returned 1 [0066.286] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0066.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0066.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0066.287] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.287] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0066.287] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 1 [0066.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 0xffffffff [0066.288] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.288] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0066.288] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0066.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0066.289] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0066.289] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.289] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0066.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0066.289] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0066.289] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0066.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.290] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0066.290] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0066.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0066.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0066.290] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0066.290] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0066.291] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0066.517] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb2, lpOverlapped=0x0) returned 1 [0066.518] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0066.519] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.542] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.553] CloseHandle (hObject=0x114) returned 1 [0066.553] CloseHandle (hObject=0x118) returned 1 [0066.554] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0 [0066.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0x2020 [0066.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0066.555] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.555] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0066.555] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 1 [0066.556] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0066.556] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.556] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0066.556] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="en_US", cAlternateFileName="")) returned 1 [0066.556] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0066.604] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0066.605] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.605] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0066.605] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.605] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0066.605] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0066.605] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0066.605] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.605] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0066.605] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0066.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0066.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0066.607] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0066.607] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0066.607] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0066.753] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x109, lpOverlapped=0x0) returned 1 [0066.782] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0066.783] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.806] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.817] CloseHandle (hObject=0x118) returned 1 [0066.817] CloseHandle (hObject=0x114) returned 1 [0066.818] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\6d65737361676573.json")) returned 0 [0066.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\6d65737361676573.json")) returned 0x2020 [0066.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0066.819] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.819] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0066.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 1 [0066.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0066.820] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.820] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0066.820] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0066.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0066.821] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0066.821] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.821] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0066.821] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.821] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0066.821] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0066.821] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0066.821] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.821] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0066.822] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0066.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0066.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0066.823] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc [0066.823] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0066.823] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0066.917] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xcc, lpOverlapped=0x0) returned 1 [0066.919] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0066.920] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.944] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.955] CloseHandle (hObject=0x114) returned 1 [0066.955] CloseHandle (hObject=0x118) returned 1 [0066.956] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0066.956] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0066.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0066.957] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.957] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0066.957] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 1 [0066.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 0xffffffff [0066.958] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.958] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0066.958] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="es_419", cAlternateFileName="")) returned 1 [0066.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0066.959] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0066.960] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.960] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0066.960] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.960] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0066.960] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0066.960] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0066.960] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0066.960] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0066.960] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0066.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0066.961] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0066.961] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0066.961] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0066.961] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0067.062] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe3, lpOverlapped=0x0) returned 1 [0067.063] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0067.064] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.089] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.100] CloseHandle (hObject=0x118) returned 1 [0067.101] CloseHandle (hObject=0x114) returned 1 [0067.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\6d65737361676573.json")) returned 0 [0067.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\6d65737361676573.json")) returned 0x2020 [0067.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0067.102] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.102] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0067.103] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 1 [0067.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0067.104] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.104] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0067.104] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="et", cAlternateFileName="")) returned 1 [0067.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0067.104] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0067.104] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.104] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0067.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.104] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0067.104] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0067.105] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0067.105] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.105] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0067.105] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0067.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0067.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0067.106] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0067.106] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0067.106] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0067.193] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd4, lpOverlapped=0x0) returned 1 [0067.194] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0067.195] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.218] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.230] CloseHandle (hObject=0x114) returned 1 [0067.230] CloseHandle (hObject=0x118) returned 1 [0067.231] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\6d65737361676573.json")) returned 0 [0067.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\6d65737361676573.json")) returned 0x2020 [0067.231] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0067.231] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.232] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0067.232] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 1 [0067.233] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 0xffffffff [0067.233] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.233] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0067.233] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="eu", cAlternateFileName="")) returned 1 [0067.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0067.234] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0067.234] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.234] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0067.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0067.234] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0067.235] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0067.235] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.235] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0067.235] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0067.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0067.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0067.235] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98 [0067.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0067.236] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0067.329] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x98, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x98, lpOverlapped=0x0) returned 1 [0067.330] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xa0, lpOverlapped=0x0) returned 1 [0067.331] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.354] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.365] CloseHandle (hObject=0x118) returned 1 [0067.366] CloseHandle (hObject=0x114) returned 1 [0067.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\6d65737361676573.json")) returned 0 [0067.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\6d65737361676573.json")) returned 0x2020 [0067.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0067.367] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.367] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0067.368] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 1 [0067.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 0xffffffff [0067.377] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.377] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0067.378] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="fa", cAlternateFileName="")) returned 1 [0067.378] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0067.378] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0067.378] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.378] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0067.378] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.378] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0067.378] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0067.379] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0067.379] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.379] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0067.379] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0067.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0067.380] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0067.380] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0067.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0067.380] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0067.468] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xff, lpOverlapped=0x0) returned 1 [0067.469] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0067.470] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.496] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.508] CloseHandle (hObject=0x114) returned 1 [0067.508] CloseHandle (hObject=0x118) returned 1 [0067.510] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\6d65737361676573.json")) returned 0 [0067.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\6d65737361676573.json")) returned 0x2020 [0067.510] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0067.510] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.511] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0067.511] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 1 [0067.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 0xffffffff [0067.512] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.512] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0067.512] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0067.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0067.525] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0067.527] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.529] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0067.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.532] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0067.532] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0067.533] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0067.533] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.533] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0067.533] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0067.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0067.536] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0067.536] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0067.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0067.537] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0067.647] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb7, lpOverlapped=0x0) returned 1 [0067.650] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0067.651] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.674] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.686] CloseHandle (hObject=0x118) returned 1 [0067.686] CloseHandle (hObject=0x114) returned 1 [0067.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0067.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0067.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0067.688] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.688] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0067.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 1 [0067.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0067.689] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.689] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0067.689] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0067.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0067.689] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0067.689] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.689] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0067.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0067.690] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0067.690] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0067.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0067.690] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0067.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0067.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0067.691] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc7 [0067.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0067.691] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0067.794] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc7, lpOverlapped=0x0) returned 1 [0067.795] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0067.796] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.818] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.831] CloseHandle (hObject=0x114) returned 1 [0067.832] CloseHandle (hObject=0x118) returned 1 [0067.833] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0067.833] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0067.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0067.833] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.833] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0067.834] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 1 [0067.835] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0067.835] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.835] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0067.835] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0067.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0067.837] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0067.837] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.837] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0067.837] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.837] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0067.837] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0067.838] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0067.838] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.838] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0067.838] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0067.838] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0067.838] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0067.839] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0067.839] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0067.839] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0067.937] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xbb, lpOverlapped=0x0) returned 1 [0067.938] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0067.939] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.965] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.977] CloseHandle (hObject=0x118) returned 1 [0067.977] CloseHandle (hObject=0x114) returned 1 [0067.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0067.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0067.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0067.979] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.979] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0067.979] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 1 [0067.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0067.981] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.981] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0067.981] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="fr_CA", cAlternateFileName="")) returned 1 [0067.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0067.986] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0067.986] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.986] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0067.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0067.986] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0067.987] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0067.987] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0067.987] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0067.987] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0067.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0067.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0067.988] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0067.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0067.988] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0068.068] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd2, lpOverlapped=0x0) returned 1 [0068.072] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0068.073] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.096] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.107] CloseHandle (hObject=0x114) returned 1 [0068.107] CloseHandle (hObject=0x118) returned 1 [0068.108] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\6d65737361676573.json")) returned 0 [0068.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\6d65737361676573.json")) returned 0x2020 [0068.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0068.109] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.109] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0068.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 1 [0068.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 0xffffffff [0068.110] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.110] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0068.110] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="gl", cAlternateFileName="")) returned 1 [0068.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0068.110] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0068.110] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.110] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0068.111] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0068.111] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0068.111] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0068.111] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0068.111] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0068.111] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0068.111] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0068.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0068.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0068.160] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac [0068.160] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0068.160] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0068.276] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xac, lpOverlapped=0x0) returned 1 [0068.277] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xb0, lpOverlapped=0x0) returned 1 [0068.278] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.310] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.321] CloseHandle (hObject=0x118) returned 1 [0068.321] CloseHandle (hObject=0x114) returned 1 [0068.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\6d65737361676573.json")) returned 0 [0068.323] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\6d65737361676573.json")) returned 0x2020 [0068.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0068.323] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.323] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0068.323] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 1 [0068.324] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 0xffffffff [0068.324] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.324] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0068.324] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="gu", cAlternateFileName="")) returned 1 [0068.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0068.325] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0068.325] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.325] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0068.325] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0068.325] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0068.325] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0068.325] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0068.325] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0068.325] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0068.326] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0068.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0068.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0068.326] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e [0068.326] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0068.327] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0068.443] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x11e, lpOverlapped=0x0) returned 1 [0068.475] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0068.477] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.500] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.558] CloseHandle (hObject=0x114) returned 1 [0068.558] CloseHandle (hObject=0x118) returned 1 [0068.559] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\6d65737361676573.json")) returned 0 [0068.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\6d65737361676573.json")) returned 0x2020 [0068.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0068.560] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.560] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0068.560] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 1 [0068.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 0xffffffff [0068.561] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.561] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0068.562] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0068.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0068.562] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0068.562] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.562] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0068.562] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0068.562] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0068.562] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0068.563] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0068.563] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0068.563] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0068.563] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0068.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0068.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0068.566] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0068.566] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0068.566] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0068.722] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x13e, lpOverlapped=0x0) returned 1 [0068.723] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x140, lpOverlapped=0x0) returned 1 [0068.724] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.810] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.822] CloseHandle (hObject=0x118) returned 1 [0068.822] CloseHandle (hObject=0x114) returned 1 [0068.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0068.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0068.824] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0068.824] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.824] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0068.824] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 1 [0068.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0068.826] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.826] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0068.826] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="hr", cAlternateFileName="")) returned 1 [0068.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0068.826] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0068.827] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.827] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0068.827] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0068.827] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0068.827] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0068.827] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0068.827] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0068.827] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0068.827] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0068.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0068.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0068.828] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8 [0068.828] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0068.829] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0069.027] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc8, lpOverlapped=0x0) returned 1 [0069.027] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0069.028] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0069.140] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.151] CloseHandle (hObject=0x114) returned 1 [0069.152] CloseHandle (hObject=0x118) returned 1 [0069.153] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\6d65737361676573.json")) returned 0 [0069.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\6d65737361676573.json")) returned 0x2020 [0069.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0069.153] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0069.153] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0069.154] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 1 [0069.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0069.155] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0069.155] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0069.155] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0069.155] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0069.155] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0069.155] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.155] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0069.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0069.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0069.155] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0069.156] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0069.156] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0069.156] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0069.156] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0069.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0069.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0069.212] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0069.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0069.212] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0069.487] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc6, lpOverlapped=0x0) returned 1 [0069.488] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0069.489] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0069.512] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.567] CloseHandle (hObject=0x118) returned 1 [0069.567] CloseHandle (hObject=0x114) returned 1 [0069.569] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0069.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0069.569] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0069.570] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0069.570] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0069.570] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 1 [0069.571] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0069.571] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0069.571] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0069.571] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="hy", cAlternateFileName="")) returned 1 [0069.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0069.571] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0069.571] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.571] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0069.571] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0069.572] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0069.572] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0069.572] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0069.572] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0069.572] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0069.572] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0069.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0069.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0069.573] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x299 [0069.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0069.573] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0069.853] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x299, lpOverlapped=0x0) returned 1 [0069.855] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0069.856] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0069.879] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.890] CloseHandle (hObject=0x114) returned 1 [0069.890] CloseHandle (hObject=0x118) returned 1 [0069.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\6d65737361676573.json")) returned 0 [0069.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\6d65737361676573.json")) returned 0x2020 [0069.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0069.893] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0069.893] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0069.894] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 1 [0069.895] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 0xffffffff [0069.895] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0069.895] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0069.895] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0069.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0069.895] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0069.895] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.895] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0069.895] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0069.895] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0069.895] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0069.940] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0069.940] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0069.940] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0069.941] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0069.941] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0069.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0069.975] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0069.975] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0069.976] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0070.142] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xbb, lpOverlapped=0x0) returned 1 [0070.143] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0070.144] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.167] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.220] CloseHandle (hObject=0x118) returned 1 [0070.220] CloseHandle (hObject=0x114) returned 1 [0070.221] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0070.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0070.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0070.222] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0070.222] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0070.223] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 1 [0070.223] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 0xffffffff [0070.223] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0070.224] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0070.224] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="is", cAlternateFileName="")) returned 1 [0070.224] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0070.224] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0070.224] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.224] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0070.224] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0070.224] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0070.225] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0070.225] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0070.225] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0070.225] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0070.225] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0070.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0070.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0070.226] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0070.226] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0070.226] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0070.402] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb2, lpOverlapped=0x0) returned 1 [0070.403] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0070.404] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.464] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.475] CloseHandle (hObject=0x114) returned 1 [0070.476] CloseHandle (hObject=0x118) returned 1 [0070.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\6d65737361676573.json")) returned 0 [0070.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\6d65737361676573.json")) returned 0x2020 [0070.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0070.478] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0070.478] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0070.478] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 1 [0070.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 0xffffffff [0070.479] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0070.479] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0070.479] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0070.479] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0070.479] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0070.479] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.480] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0070.480] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0070.480] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0070.480] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0070.480] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0070.480] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0070.480] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0070.480] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0070.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0070.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0070.522] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6 [0070.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0070.522] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0070.718] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb6, lpOverlapped=0x0) returned 1 [0070.753] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0070.754] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.777] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.832] CloseHandle (hObject=0x118) returned 1 [0070.833] CloseHandle (hObject=0x114) returned 1 [0070.833] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0070.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0070.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0070.834] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0070.834] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0070.835] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 1 [0070.835] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 0xffffffff [0070.835] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0070.836] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0070.836] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="iw", cAlternateFileName="")) returned 1 [0070.836] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0070.836] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0070.836] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.836] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0070.836] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0070.836] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0070.836] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0070.837] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0070.837] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0070.837] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0070.837] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0070.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0070.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0070.838] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a [0070.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0070.838] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0071.005] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x16a, lpOverlapped=0x0) returned 1 [0071.006] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x170, lpOverlapped=0x0) returned 1 [0071.008] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.082] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.095] CloseHandle (hObject=0x114) returned 1 [0071.096] CloseHandle (hObject=0x118) returned 1 [0071.099] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\6d65737361676573.json")) returned 0 [0071.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\6d65737361676573.json")) returned 0x2020 [0071.100] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0071.100] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.100] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0071.100] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 1 [0071.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 0xffffffff [0071.102] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.102] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0071.102] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0071.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0071.103] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0071.104] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.104] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0071.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0071.104] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0071.104] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0071.104] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0071.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0071.105] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0071.105] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0071.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0071.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0071.141] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0071.141] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0071.141] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0071.328] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfb, lpOverlapped=0x0) returned 1 [0071.362] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0071.389] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.412] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.423] CloseHandle (hObject=0x118) returned 1 [0071.423] CloseHandle (hObject=0x114) returned 1 [0071.424] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0071.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0071.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0071.470] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.470] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0071.470] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 1 [0071.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0071.471] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.471] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0071.471] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ka", cAlternateFileName="")) returned 1 [0071.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0071.472] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0071.472] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.472] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0071.472] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0071.472] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0071.472] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0071.472] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0071.472] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0071.472] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0071.472] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0071.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0071.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0071.473] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x165 [0071.473] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0071.474] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0071.686] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x165, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x165, lpOverlapped=0x0) returned 1 [0071.687] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x170, lpOverlapped=0x0) returned 1 [0071.847] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.875] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.886] CloseHandle (hObject=0x114) returned 1 [0071.886] CloseHandle (hObject=0x118) returned 1 [0071.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\6d65737361676573.json")) returned 0 [0071.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\6d65737361676573.json")) returned 0x2020 [0071.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0071.888] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.888] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0071.889] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 1 [0071.890] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 0xffffffff [0071.890] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.890] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0071.890] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="km", cAlternateFileName="")) returned 1 [0071.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0071.890] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0071.890] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.890] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0071.890] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0071.890] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0071.891] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0071.891] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0071.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0071.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0071.891] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0071.891] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0071.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0071.928] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25f [0071.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0071.928] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0072.102] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x25f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x25f, lpOverlapped=0x0) returned 1 [0072.109] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x260, lpOverlapped=0x0) returned 1 [0072.110] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.132] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.176] CloseHandle (hObject=0x118) returned 1 [0072.177] CloseHandle (hObject=0x114) returned 1 [0072.178] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\6d65737361676573.json")) returned 0 [0072.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\6d65737361676573.json")) returned 0x2020 [0072.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0072.178] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0072.178] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0072.179] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 1 [0072.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 0xffffffff [0072.180] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0072.180] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0072.180] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="kn", cAlternateFileName="")) returned 1 [0072.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0072.180] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0072.180] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.180] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0072.180] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0072.181] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0072.181] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0072.181] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0072.181] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0072.181] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0072.181] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0072.181] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0072.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0072.182] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x147 [0072.182] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0072.182] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0072.358] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x147, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x147, lpOverlapped=0x0) returned 1 [0072.359] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x150, lpOverlapped=0x0) returned 1 [0072.360] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.415] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.535] CloseHandle (hObject=0x114) returned 1 [0072.535] CloseHandle (hObject=0x118) returned 1 [0072.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\6d65737361676573.json")) returned 0 [0072.537] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\6d65737361676573.json")) returned 0x2020 [0072.537] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0072.537] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0072.538] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0072.538] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 1 [0072.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 0xffffffff [0072.539] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0072.539] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0072.539] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0072.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0072.539] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0072.539] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.539] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0072.539] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0072.540] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0072.540] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0072.540] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0072.540] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0072.540] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0072.540] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0072.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0072.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0072.576] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0072.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0072.576] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0072.701] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd9, lpOverlapped=0x0) returned 1 [0072.735] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0072.736] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.759] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.770] CloseHandle (hObject=0x118) returned 1 [0072.770] CloseHandle (hObject=0x114) returned 1 [0072.771] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0072.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0072.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0072.772] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0072.772] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0072.772] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 1 [0072.773] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0072.773] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0072.773] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0072.811] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="lo", cAlternateFileName="")) returned 1 [0072.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0072.812] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0072.812] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.812] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0072.812] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0072.812] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0072.812] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0072.812] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0072.812] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0072.812] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0072.812] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0072.813] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0072.813] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0072.813] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c2 [0072.813] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0072.814] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0073.003] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x1c2, lpOverlapped=0x0) returned 1 [0073.004] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x1d0, lpOverlapped=0x0) returned 1 [0073.005] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.028] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.089] CloseHandle (hObject=0x114) returned 1 [0073.090] CloseHandle (hObject=0x118) returned 1 [0073.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\6d65737361676573.json")) returned 0 [0073.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\6d65737361676573.json")) returned 0x2020 [0073.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0073.096] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.096] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0073.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 1 [0073.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 0xffffffff [0073.097] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.097] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0073.098] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0073.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0073.143] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0073.143] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.147] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0073.147] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0073.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0073.152] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0073.152] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0073.152] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0073.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0073.152] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0073.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0073.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0073.188] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0073.188] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0073.189] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0073.430] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd5, lpOverlapped=0x0) returned 1 [0073.431] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0073.432] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.455] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.466] CloseHandle (hObject=0x118) returned 1 [0073.466] CloseHandle (hObject=0x114) returned 1 [0073.467] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0073.467] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0073.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0073.468] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.468] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0073.468] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 1 [0073.516] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0073.516] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.516] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0073.517] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0073.517] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0073.517] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0073.517] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.517] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0073.517] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0073.517] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0073.517] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0073.518] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0073.518] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0073.518] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0073.518] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0073.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0073.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0073.519] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0073.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0073.519] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0073.724] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc6, lpOverlapped=0x0) returned 1 [0073.725] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0073.813] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.836] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.847] CloseHandle (hObject=0x114) returned 1 [0073.848] CloseHandle (hObject=0x118) returned 1 [0073.849] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0073.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0073.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0073.849] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.849] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0073.849] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 1 [0073.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0073.850] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.850] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0073.851] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ml", cAlternateFileName="")) returned 1 [0073.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0073.851] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0073.851] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.851] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0073.851] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0073.851] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0073.851] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0073.852] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0073.852] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0073.852] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0073.852] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0073.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0073.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0073.892] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x183 [0073.892] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0073.892] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0074.021] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x183, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x183, lpOverlapped=0x0) returned 1 [0074.061] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x190, lpOverlapped=0x0) returned 1 [0074.062] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.086] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.097] CloseHandle (hObject=0x118) returned 1 [0074.097] CloseHandle (hObject=0x114) returned 1 [0074.098] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\6d65737361676573.json")) returned 0 [0074.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\6d65737361676573.json")) returned 0x2020 [0074.099] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0074.099] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.099] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0074.099] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 1 [0074.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 0xffffffff [0074.100] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.100] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0074.101] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="mn", cAlternateFileName="")) returned 1 [0074.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0074.101] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0074.101] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.101] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0074.101] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0074.101] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0074.101] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0074.102] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0074.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0074.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0074.102] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0074.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0074.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0074.103] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c3 [0074.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0074.103] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0074.353] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x1c3, lpOverlapped=0x0) returned 1 [0074.354] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x1d0, lpOverlapped=0x0) returned 1 [0074.355] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.471] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.483] CloseHandle (hObject=0x114) returned 1 [0074.483] CloseHandle (hObject=0x118) returned 1 [0074.484] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\6d65737361676573.json")) returned 0 [0074.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\6d65737361676573.json")) returned 0x2020 [0074.485] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0074.485] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.485] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0074.485] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 1 [0074.486] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 0xffffffff [0074.486] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.486] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0074.486] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="mr", cAlternateFileName="")) returned 1 [0074.486] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0074.486] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0074.486] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.487] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0074.487] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0074.487] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0074.487] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0074.487] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0074.487] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0074.487] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0074.487] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0074.487] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0074.529] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0074.530] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c [0074.530] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0074.530] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0074.703] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x12c, lpOverlapped=0x0) returned 1 [0074.704] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0074.705] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.782] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.793] CloseHandle (hObject=0x118) returned 1 [0074.793] CloseHandle (hObject=0x114) returned 1 [0074.795] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\6d65737361676573.json")) returned 0 [0074.795] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\6d65737361676573.json")) returned 0x2020 [0074.795] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0074.795] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.795] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0074.796] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 1 [0074.797] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 0xffffffff [0074.797] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.797] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0074.797] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ms", cAlternateFileName="")) returned 1 [0074.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0074.797] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0074.797] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.798] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0074.798] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0074.798] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0074.798] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0074.798] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0074.798] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0074.798] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0074.798] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0074.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0074.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0074.799] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb [0074.799] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0074.799] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0074.989] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xcb, lpOverlapped=0x0) returned 1 [0075.028] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0075.029] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.052] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.064] CloseHandle (hObject=0x114) returned 1 [0075.064] CloseHandle (hObject=0x118) returned 1 [0075.065] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\6d65737361676573.json")) returned 0 [0075.065] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\6d65737361676573.json")) returned 0x2020 [0075.065] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0075.066] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.066] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0075.066] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 1 [0075.067] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0075.067] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.067] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0075.067] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ne", cAlternateFileName="")) returned 1 [0075.067] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0075.067] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0075.067] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.068] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0075.068] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0075.068] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0075.068] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0075.068] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0075.068] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0075.068] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0075.068] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0075.068] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0075.069] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0075.069] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20b [0075.069] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0075.069] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0075.260] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x20b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x20b, lpOverlapped=0x0) returned 1 [0075.294] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x210, lpOverlapped=0x0) returned 1 [0075.295] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.318] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.329] CloseHandle (hObject=0x118) returned 1 [0075.329] CloseHandle (hObject=0x114) returned 1 [0075.330] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\6d65737361676573.json")) returned 0 [0075.331] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\6d65737361676573.json")) returned 0x2020 [0075.331] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0075.331] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.331] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0075.331] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 1 [0075.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 0xffffffff [0075.332] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.332] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0075.332] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0075.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0075.381] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0075.381] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.381] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0075.381] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0075.381] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0075.381] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0075.382] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0075.382] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0075.382] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0075.382] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0075.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0075.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0075.383] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0075.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0075.383] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0075.564] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb1, lpOverlapped=0x0) returned 1 [0075.565] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0075.566] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.590] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.646] CloseHandle (hObject=0x114) returned 1 [0075.647] CloseHandle (hObject=0x118) returned 1 [0075.651] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0075.652] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0075.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0075.652] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.652] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0075.652] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 1 [0075.653] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0075.653] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.653] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0075.653] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="no", cAlternateFileName="")) returned 1 [0075.653] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0075.654] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0075.654] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.654] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0075.654] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0075.654] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0075.654] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0075.655] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0075.655] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0075.655] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0075.655] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0075.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0075.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0075.656] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96 [0075.656] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0075.656] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0075.844] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x96, lpOverlapped=0x0) returned 1 [0075.845] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xa0, lpOverlapped=0x0) returned 1 [0075.846] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.920] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.931] CloseHandle (hObject=0x118) returned 1 [0075.931] CloseHandle (hObject=0x114) returned 1 [0075.932] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\6d65737361676573.json")) returned 0 [0075.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\6d65737361676573.json")) returned 0x2020 [0075.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0075.933] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.933] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0075.933] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 1 [0075.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 0xffffffff [0075.934] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.934] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0075.934] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0075.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0075.982] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0075.983] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.983] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0075.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0075.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0075.983] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0075.983] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0075.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0075.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0075.983] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0075.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0075.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0075.984] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4 [0075.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0075.985] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0076.175] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb4, lpOverlapped=0x0) returned 1 [0076.176] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0076.177] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.247] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.258] CloseHandle (hObject=0x114) returned 1 [0076.259] CloseHandle (hObject=0x118) returned 1 [0076.260] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0076.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0076.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0076.282] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.283] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0076.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 1 [0076.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0076.285] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.285] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0076.285] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0076.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0076.286] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0076.286] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.287] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0076.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0076.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0076.287] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0076.287] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0076.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0076.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0076.288] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0076.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0076.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0076.289] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0076.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0076.290] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0076.528] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xbb, lpOverlapped=0x0) returned 1 [0076.529] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0076.530] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.553] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.564] CloseHandle (hObject=0x118) returned 1 [0076.564] CloseHandle (hObject=0x114) returned 1 [0076.565] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0076.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0076.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0076.566] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.566] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0076.566] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 1 [0076.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0076.567] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.567] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0076.568] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0076.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0076.620] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0076.620] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.620] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0076.620] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0076.620] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0076.620] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0076.621] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0076.621] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0076.621] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0076.621] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0076.621] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0076.621] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0076.622] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0076.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0076.622] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0076.793] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc6, lpOverlapped=0x0) returned 1 [0076.794] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0076.795] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.817] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.828] CloseHandle (hObject=0x114) returned 1 [0076.829] CloseHandle (hObject=0x118) returned 1 [0076.830] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0076.830] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0076.830] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0076.830] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.830] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0076.831] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 1 [0076.831] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0076.831] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.831] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0076.832] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0076.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0076.832] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0076.832] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.832] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0076.832] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0076.832] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0076.832] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0076.833] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0076.833] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0076.833] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0076.833] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0076.833] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0076.833] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0076.834] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0076.834] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0076.834] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0077.023] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xaf, lpOverlapped=0x0) returned 1 [0077.057] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xb0, lpOverlapped=0x0) returned 1 [0077.058] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.081] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.092] CloseHandle (hObject=0x118) returned 1 [0077.093] CloseHandle (hObject=0x114) returned 1 [0077.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0077.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0077.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0077.095] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.095] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0077.095] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 1 [0077.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0077.096] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.096] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0077.096] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0077.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0077.135] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0077.135] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.135] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0077.135] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0077.135] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0077.135] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0077.136] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0077.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0077.136] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0077.136] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0077.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0077.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0077.137] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0077.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0077.137] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0077.258] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x119, lpOverlapped=0x0) returned 1 [0077.259] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0077.260] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.330] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.340] CloseHandle (hObject=0x114) returned 1 [0077.341] CloseHandle (hObject=0x118) returned 1 [0077.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0077.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0077.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0077.342] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.343] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0077.343] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 1 [0077.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0077.344] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.344] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0077.344] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="si", cAlternateFileName="")) returned 1 [0077.344] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0077.344] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0077.344] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.344] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0077.344] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0077.344] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0077.345] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0077.345] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0077.345] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0077.345] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0077.345] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0077.345] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0077.346] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0077.346] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e [0077.346] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0077.346] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0077.576] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x14e, lpOverlapped=0x0) returned 1 [0077.577] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x150, lpOverlapped=0x0) returned 1 [0077.578] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.601] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.670] CloseHandle (hObject=0x118) returned 1 [0077.670] CloseHandle (hObject=0x114) returned 1 [0077.671] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\6d65737361676573.json")) returned 0 [0077.671] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\6d65737361676573.json")) returned 0x2020 [0077.672] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0077.672] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.672] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0077.672] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 1 [0077.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 0xffffffff [0077.673] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.673] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0077.673] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0077.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0077.712] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0077.712] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.712] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0077.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0077.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0077.712] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0077.712] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0077.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0077.713] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0077.713] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0077.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0077.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0077.714] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5 [0077.714] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0077.714] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0077.896] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc5, lpOverlapped=0x0) returned 1 [0077.899] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0077.901] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.928] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.986] CloseHandle (hObject=0x114) returned 1 [0077.986] CloseHandle (hObject=0x118) returned 1 [0077.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0077.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0077.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0077.990] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.990] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0077.990] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 1 [0077.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0077.991] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.991] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0077.992] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0077.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0077.993] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0077.993] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.993] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0077.993] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0077.993] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0077.993] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0077.994] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0077.994] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0077.994] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0077.994] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0077.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0077.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0077.995] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe [0077.995] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0077.995] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0078.180] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xbe, lpOverlapped=0x0) returned 1 [0078.181] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0078.182] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.205] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.263] CloseHandle (hObject=0x118) returned 1 [0078.263] CloseHandle (hObject=0x114) returned 1 [0078.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0078.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0078.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0078.265] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.265] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0078.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 1 [0078.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0078.266] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.266] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0078.266] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0078.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0078.320] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0078.320] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.320] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0078.320] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0078.321] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0078.321] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0078.321] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0078.321] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0078.321] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0078.321] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0078.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0078.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0078.322] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0078.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0078.322] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0078.508] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x104, lpOverlapped=0x0) returned 1 [0078.509] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0078.510] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.532] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.543] CloseHandle (hObject=0x114) returned 1 [0078.543] CloseHandle (hObject=0x118) returned 1 [0078.544] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0078.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0078.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0078.545] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.545] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0078.545] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 1 [0078.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0078.546] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.546] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0078.546] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="sv", cAlternateFileName="")) returned 1 [0078.546] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0078.547] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0078.547] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.547] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0078.547] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0078.547] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0078.547] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0078.547] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0078.547] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0078.548] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0078.548] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0078.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0078.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0078.548] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0078.548] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0078.549] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0078.718] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb3, lpOverlapped=0x0) returned 1 [0078.720] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0078.721] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.790] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.801] CloseHandle (hObject=0x118) returned 1 [0078.802] CloseHandle (hObject=0x114) returned 1 [0078.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\6d65737361676573.json")) returned 0 [0078.804] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\6d65737361676573.json")) returned 0x2020 [0078.804] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0078.804] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.804] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0078.804] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 1 [0078.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0078.805] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.805] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0078.805] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="sw", cAlternateFileName="")) returned 1 [0078.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0078.852] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0078.852] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.852] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0078.852] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0078.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0078.853] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0078.853] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0078.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0078.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0078.853] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0078.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0078.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0078.854] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0078.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0078.855] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0079.038] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc4, lpOverlapped=0x0) returned 1 [0079.084] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0079.085] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.108] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.119] CloseHandle (hObject=0x114) returned 1 [0079.119] CloseHandle (hObject=0x118) returned 1 [0079.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\6d65737361676573.json")) returned 0 [0079.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\6d65737361676573.json")) returned 0x2020 [0079.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0079.121] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.121] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0079.121] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 1 [0079.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 0xffffffff [0079.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.122] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0079.122] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ta", cAlternateFileName="")) returned 1 [0079.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0079.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0079.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.123] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0079.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0079.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0079.123] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0079.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0079.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0079.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0079.123] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0079.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0079.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0079.124] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150 [0079.124] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0079.124] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0079.292] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x150, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x150, lpOverlapped=0x0) returned 1 [0079.293] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x160, lpOverlapped=0x0) returned 1 [0079.294] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.422] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.433] CloseHandle (hObject=0x118) returned 1 [0079.434] CloseHandle (hObject=0x114) returned 1 [0079.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\6d65737361676573.json")) returned 0 [0079.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\6d65737361676573.json")) returned 0x2020 [0079.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0079.435] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.435] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0079.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 1 [0079.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 0xffffffff [0079.436] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.437] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0079.437] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="te", cAlternateFileName="")) returned 1 [0079.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0079.490] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0079.490] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.491] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0079.491] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0079.491] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0079.491] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0079.491] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0079.491] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0079.491] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0079.491] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0079.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0079.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0079.492] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0079.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0079.494] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0079.669] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x115, lpOverlapped=0x0) returned 1 [0079.670] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0079.671] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.741] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.752] CloseHandle (hObject=0x114) returned 1 [0079.752] CloseHandle (hObject=0x118) returned 1 [0079.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\6d65737361676573.json")) returned 0 [0079.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\6d65737361676573.json")) returned 0x2020 [0079.754] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0079.754] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.754] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0079.754] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 1 [0079.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 0xffffffff [0079.755] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.755] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0079.755] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0079.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0079.756] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0079.756] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.756] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0079.756] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0079.756] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0079.756] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0079.756] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0079.756] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0079.756] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0079.756] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0079.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0079.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0079.757] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0079.757] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0079.758] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0079.934] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x125, lpOverlapped=0x0) returned 1 [0079.935] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0079.936] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.959] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.970] CloseHandle (hObject=0x118) returned 1 [0079.970] CloseHandle (hObject=0x114) returned 1 [0079.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0079.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0079.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0079.972] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.972] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0079.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 1 [0079.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 0xffffffff [0079.973] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.973] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0079.973] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0079.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0080.067] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0080.067] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0080.068] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0080.068] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0080.068] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0080.068] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0080.068] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0080.068] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0080.068] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0080.068] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0080.068] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0080.069] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0080.069] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd [0080.069] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0080.070] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0080.248] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xcd, lpOverlapped=0x0) returned 1 [0080.249] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0080.253] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.336] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.350] CloseHandle (hObject=0x114) returned 1 [0080.350] CloseHandle (hObject=0x118) returned 1 [0080.354] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0080.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0080.355] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0080.355] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.356] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0080.356] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 1 [0080.357] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0080.357] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.357] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0080.357] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0080.357] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0080.357] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0080.358] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0080.360] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0080.360] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0080.363] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0080.363] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0080.363] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0080.363] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0080.410] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0080.410] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0080.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0080.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0080.412] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0080.412] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0080.412] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0080.539] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x115, lpOverlapped=0x0) returned 1 [0080.582] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0080.583] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.605] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.616] CloseHandle (hObject=0x118) returned 1 [0080.617] CloseHandle (hObject=0x114) returned 1 [0080.618] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0080.618] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0080.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0080.618] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.618] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0080.619] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 1 [0080.619] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0080.620] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.620] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0080.620] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="ur", cAlternateFileName="")) returned 1 [0080.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0080.660] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0080.660] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0080.660] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0080.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0080.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0080.661] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0080.661] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0080.661] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0080.661] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0080.661] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0080.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0080.662] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0080.662] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x177 [0080.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0080.662] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0080.796] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x177, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x177, lpOverlapped=0x0) returned 1 [0080.831] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x180, lpOverlapped=0x0) returned 1 [0080.832] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.855] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.867] CloseHandle (hObject=0x114) returned 1 [0080.867] CloseHandle (hObject=0x118) returned 1 [0080.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\6d65737361676573.json")) returned 0 [0080.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\6d65737361676573.json")) returned 0x2020 [0080.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0080.869] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.869] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0080.869] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 1 [0080.870] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 0xffffffff [0080.870] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.870] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0080.870] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0080.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0080.871] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0080.871] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0080.871] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0080.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0080.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0080.871] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0080.872] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0080.872] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0080.872] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0080.872] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0080.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0080.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0080.873] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0080.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0080.873] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0081.058] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdd, lpOverlapped=0x0) returned 1 [0081.097] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0081.098] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.120] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.131] CloseHandle (hObject=0x118) returned 1 [0081.132] CloseHandle (hObject=0x114) returned 1 [0081.136] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0081.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0081.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0081.137] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0081.137] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0081.137] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 1 [0081.138] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0081.138] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0081.138] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0081.138] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0081.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0081.191] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0081.191] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0081.191] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0081.191] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0081.191] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0081.191] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0081.191] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0081.191] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0081.191] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0081.192] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0081.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0081.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0081.193] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0081.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0081.193] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0081.313] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xb0, lpOverlapped=0x0) returned 1 [0081.314] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xc0, lpOverlapped=0x0) returned 1 [0081.316] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.430] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.441] CloseHandle (hObject=0x114) returned 1 [0081.441] CloseHandle (hObject=0x118) returned 1 [0081.442] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0 [0081.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0x2020 [0081.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0081.443] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0081.443] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0081.443] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 1 [0081.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0081.445] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0081.445] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0081.445] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="zh_HK", cAlternateFileName="")) returned 1 [0081.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0081.445] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0081.445] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0081.445] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0081.445] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0081.445] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0081.445] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0081.446] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0081.446] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0081.446] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0081.446] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0081.446] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0081.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0081.447] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0081.447] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0081.447] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0081.621] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd2, lpOverlapped=0x0) returned 1 [0081.623] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0081.624] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.647] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.658] CloseHandle (hObject=0x118) returned 1 [0081.659] CloseHandle (hObject=0x114) returned 1 [0081.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\6d65737361676573.json")) returned 0 [0081.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\6d65737361676573.json")) returned 0x2020 [0081.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0081.706] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0081.706] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0081.706] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 1 [0081.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 0xffffffff [0081.707] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0081.707] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0081.707] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0081.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0081.752] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0081.753] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0081.753] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0081.753] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0081.753] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0081.753] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0081.753] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0081.753] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0081.753] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0081.753] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0081.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0081.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0081.754] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa [0081.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0081.755] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0081.929] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xaa, lpOverlapped=0x0) returned 1 [0081.930] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xb0, lpOverlapped=0x0) returned 1 [0081.931] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.955] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.966] CloseHandle (hObject=0x114) returned 1 [0081.966] CloseHandle (hObject=0x118) returned 1 [0081.967] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0081.967] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0081.967] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0081.968] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0081.968] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0081.968] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 1 [0081.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0081.969] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0081.969] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0081.969] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="zu", cAlternateFileName="")) returned 1 [0081.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0081.970] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0081.970] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0081.970] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0081.970] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0082.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0082.017] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0082.017] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0082.017] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0082.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0082.018] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0082.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0082.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0082.019] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2 [0082.019] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0082.019] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0082.198] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xc2, lpOverlapped=0x0) returned 1 [0082.199] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xd0, lpOverlapped=0x0) returned 1 [0082.200] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.223] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.234] CloseHandle (hObject=0x118) returned 1 [0082.234] CloseHandle (hObject=0x114) returned 1 [0082.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\6d65737361676573.json")) returned 0 [0082.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\6d65737361676573.json")) returned 0x2020 [0082.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0082.283] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0082.283] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0082.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 1 [0082.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 0xffffffff [0082.284] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0082.284] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0082.285] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="zu", cAlternateFileName="")) returned 0 [0082.285] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0082.285] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0082.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0082.330] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0082.330] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x1266e6f, dwReserved1=0x31e3e0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0082.330] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0082.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0082.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0082.330] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0082.330] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0082.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0082.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0082.331] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0082.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0082.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\636f6d70757465645f686173686573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0082.443] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf3 [0082.443] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0082.444] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0082.612] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0xaf3, lpOverlapped=0x0) returned 1 [0082.613] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0xb00, lpOverlapped=0x0) returned 1 [0082.614] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.637] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.654] CloseHandle (hObject=0x110) returned 1 [0082.654] CloseHandle (hObject=0x114) returned 1 [0082.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0 [0082.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0x2020 [0082.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x325118 [0082.656] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0082.656] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0082.656] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 1 [0082.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0082.689] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0082.690] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0082.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0082.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0082.690] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0082.690] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0082.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0082.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0082.690] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0082.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0082.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0082.691] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4454 [0082.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0082.692] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0082.876] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4454, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x4454, lpOverlapped=0x0) returned 1 [0082.878] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x4460, lpOverlapped=0x0) returned 1 [0082.879] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.902] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.913] CloseHandle (hObject=0x114) returned 1 [0082.913] CloseHandle (hObject=0x110) returned 1 [0082.914] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0082.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0082.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0082.915] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0082.915] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0082.915] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 1 [0082.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0082.916] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0082.916] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0082.916] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0082.916] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0082.917] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd86e6f, dwReserved1=0x31e3e0, cFileName="1.4_0", cAlternateFileName="")) returned 0 [0082.917] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0082.917] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="nmmhkkegccagdldgiimedpiccmgmieda", cAlternateFileName="NMMHKK~1")) returned 1 [0082.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName=".", cAlternateFileName="")) returned 0x325058 [0082.917] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="..", cAlternateFileName="")) returned 1 [0082.917] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 1 [0082.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x325098 [0083.000] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0083.000] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 1 [0083.000] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0083.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0083.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0083.000] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0083.001] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0083.001] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0083.001] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0083.001] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0083.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775F6261636B67726F756E64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775f6261636b67726f756e64.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0083.047] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32a2e [0083.048] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0083.048] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0083.230] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x32a2e, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x32a2e, lpOverlapped=0x0) returned 1 [0083.237] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x32a30, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x32a30, lpOverlapped=0x0) returned 1 [0083.241] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.264] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.307] CloseHandle (hObject=0x11c) returned 1 [0083.307] CloseHandle (hObject=0x110) returned 1 [0083.311] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775F6261636B67726F756E64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775f6261636b67726f756e64.js")) returned 0 [0083.311] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775F6261636B67726F756E64.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775f6261636b67726f756e64.js")) returned 0x2020 [0083.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 0x3250d8 [0083.312] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 0 [0083.312] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0083.312] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 1 [0083.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 0xffffffff [0083.314] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8288d330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82892150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b059, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 1 [0083.314] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0083.314] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0083.314] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0083.314] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0083.315] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0083.315] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0083.315] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0083.315] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0083.315] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0083.368] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775F77696E646F77.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775f77696e646f77.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.368] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b059 [0083.369] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0083.369] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0083.542] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3b059, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x3b059, lpOverlapped=0x0) returned 1 [0083.549] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3b060, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x3b060, lpOverlapped=0x0) returned 1 [0083.554] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.641] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.652] CloseHandle (hObject=0x110) returned 1 [0083.653] CloseHandle (hObject=0x11c) returned 1 [0083.656] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775F77696E646F77.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775f77696e646f77.js")) returned 0 [0083.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775F77696E646F77.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\637261775f77696e646f77.js")) returned 0x2020 [0083.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8288d330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82892150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b059, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 0x3250d8 [0083.657] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8288d330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82892150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b059, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 0 [0083.657] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0083.657] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 1 [0083.659] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 0xffffffff [0083.659] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="css", cAlternateFileName="")) returned 1 [0083.659] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1220120, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0083.659] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1220120, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0083.659] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x1220120, dwReserved1=0x31e3e0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 1 [0083.660] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0083.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0083.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0083.660] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0083.660] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0083.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0083.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0083.660] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0083.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0083.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\637261775F77696E646F77.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\637261775f77696e646f77.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0083.661] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6cd [0083.661] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0083.662] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0083.847] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6cd, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x6cd, lpOverlapped=0x0) returned 1 [0083.849] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x6d0, lpOverlapped=0x0) returned 1 [0083.850] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.873] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.931] CloseHandle (hObject=0x110) returned 1 [0083.932] CloseHandle (hObject=0x114) returned 1 [0083.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\637261775F77696E646F77.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\637261775f77696e646f77.css")) returned 0 [0083.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\637261775F77696E646F77.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\637261775f77696e646f77.css")) returned 0x2020 [0083.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0x325118 [0083.933] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0 [0083.933] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0083.934] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 1 [0083.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 0xffffffff [0083.935] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x1220120, dwReserved1=0x31e3e0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0 [0083.935] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0083.935] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7373632e, dwReserved1=0x7758ba1b, cFileName="html", cAlternateFileName="")) returned 1 [0083.935] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0083.935] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="..", cAlternateFileName="")) returned 1 [0083.935] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 1 [0083.935] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0083.935] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0083.935] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0083.935] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0083.936] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0083.936] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0083.936] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0083.936] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0083.936] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0083.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\637261775F77696E646F77.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\637261775f77696e646f77.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0083.984] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32a [0083.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0083.984] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0084.166] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x32a, lpOverlapped=0x0) returned 1 [0084.168] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x330, lpOverlapped=0x0) returned 1 [0084.169] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.191] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.234] CloseHandle (hObject=0x114) returned 1 [0084.235] CloseHandle (hObject=0x110) returned 1 [0084.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\637261775F77696E646F77.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\637261775f77696e646f77.html")) returned 0 [0084.236] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\637261775F77696E646F77.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\637261775f77696e646f77.html")) returned 0x2020 [0084.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 0x325118 [0084.236] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 0 [0084.236] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0084.236] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 1 [0084.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 0xffffffff [0084.237] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 0 [0084.237] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0084.238] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d74682e, dwReserved1=0x7758ba6c, cFileName="images", cAlternateFileName="")) returned 1 [0084.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0084.279] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="..", cAlternateFileName="")) returned 1 [0084.279] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="flapper.gif", cAlternateFileName="")) returned 1 [0084.279] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0084.279] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0084.279] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0084.279] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0084.280] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0084.280] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0084.280] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0084.280] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0084.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0084.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\666C6170706572.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\666c6170706572.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0084.281] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112dc [0084.281] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0084.281] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0084.485] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x112dc, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x112dc, lpOverlapped=0x0) returned 1 [0084.488] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x112e0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x112e0, lpOverlapped=0x0) returned 1 [0084.493] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.572] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.583] CloseHandle (hObject=0x110) returned 1 [0084.583] CloseHandle (hObject=0x114) returned 1 [0084.585] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\666C6170706572.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\666c6170706572.gif")) returned 0 [0084.586] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\666C6170706572.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\666c6170706572.gif")) returned 0x2020 [0084.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="flapper.gif", cAlternateFileName="")) returned 0x325118 [0084.587] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="flapper.gif", cAlternateFileName="")) returned 0 [0084.587] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0084.587] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 1 [0084.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 0xffffffff [0084.588] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0084.588] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0084.589] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0084.589] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0084.589] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0084.589] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0084.589] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0084.589] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0084.589] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0084.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0084.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636f6e5f313238.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0084.590] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1109 [0084.590] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0084.591] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0084.772] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x1109, lpOverlapped=0x0) returned 1 [0084.774] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x1110, lpOverlapped=0x0) returned 1 [0084.775] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.829] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.840] CloseHandle (hObject=0x114) returned 1 [0084.840] CloseHandle (hObject=0x110) returned 1 [0084.841] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636f6e5f313238.png")) returned 0 [0084.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636F6E5F313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636f6e5f313238.png")) returned 0x2020 [0084.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="icon_128.png", cAlternateFileName="")) returned 0x325118 [0084.842] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0084.842] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0084.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 1 [0084.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 0xffffffff [0084.843] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0084.843] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0084.843] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0084.843] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0084.844] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0084.844] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0084.844] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0084.844] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0084.844] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0084.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0084.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636f6e5f3136.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0084.889] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22c [0084.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0084.890] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0085.077] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x22c, lpOverlapped=0x0) returned 1 [0085.121] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x230, lpOverlapped=0x0) returned 1 [0085.122] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.147] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.159] CloseHandle (hObject=0x110) returned 1 [0085.160] CloseHandle (hObject=0x114) returned 1 [0085.161] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636f6e5f3136.png")) returned 0 [0085.161] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636F6E5F3136.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\69636f6e5f3136.png")) returned 0x2020 [0085.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="icon_16.png", cAlternateFileName="")) returned 0x325118 [0085.162] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0085.162] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0085.162] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 1 [0085.163] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 0xffffffff [0085.163] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 1 [0085.163] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0085.163] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0085.163] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0085.163] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0085.164] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0085.164] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0085.164] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0085.164] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0085.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0085.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.165] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0085.165] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0085.165] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0085.334] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0xa0, lpOverlapped=0x0) returned 1 [0085.335] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0xb0, lpOverlapped=0x0) returned 1 [0085.336] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.422] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.433] CloseHandle (hObject=0x114) returned 1 [0085.433] CloseHandle (hObject=0x110) returned 1 [0085.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e.png")) returned 0 [0085.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e.png")) returned 0x2020 [0085.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 0x325118 [0085.435] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 0 [0085.435] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0085.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 1 [0085.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 0xffffffff [0085.436] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 1 [0085.436] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0085.436] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0085.436] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0085.436] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0085.437] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0085.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0085.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0085.437] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0085.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F636C6F7365.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f636c6f7365.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0085.438] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc [0085.438] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0085.438] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0085.558] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0xfc, lpOverlapped=0x0) returned 1 [0085.607] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x100, lpOverlapped=0x0) returned 1 [0085.619] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.642] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.700] CloseHandle (hObject=0x110) returned 1 [0085.701] CloseHandle (hObject=0x114) returned 1 [0085.702] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F636C6F7365.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f636c6f7365.png")) returned 0 [0085.702] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F636C6F7365.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f636c6f7365.png")) returned 0x2020 [0085.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x3300c8, dwReserved1=0x18dfd4, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 0x325118 [0085.703] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x3300c8, dwReserved1=0x18dfd4, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 0 [0085.703] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0085.703] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 1 [0085.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 0xffffffff [0085.704] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 1 [0085.704] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0085.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0085.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0085.704] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0085.704] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0085.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0085.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0085.705] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0085.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0085.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F686F766572.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f686f766572.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.705] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0085.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0085.706] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0085.891] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0xa0, lpOverlapped=0x0) returned 1 [0085.894] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0xb0, lpOverlapped=0x0) returned 1 [0085.895] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.923] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.982] CloseHandle (hObject=0x114) returned 1 [0085.983] CloseHandle (hObject=0x110) returned 1 [0085.984] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F686F766572.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f686f766572.png")) returned 0 [0085.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F686F766572.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f686f766572.png")) returned 0x2020 [0085.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x3300c8, dwReserved1=0x18dfd4, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 0x325118 [0085.986] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x3300c8, dwReserved1=0x18dfd4, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 0 [0085.986] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0085.986] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 1 [0085.987] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 0xffffffff [0085.987] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 1 [0085.987] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0085.987] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0085.988] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0085.988] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0085.988] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0085.988] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0085.988] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0085.988] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0085.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0086.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F6D6178696D697A65.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f6d6178696d697a65.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.012] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6 [0086.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0086.012] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0086.110] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0xa6, lpOverlapped=0x0) returned 1 [0086.111] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0xb0, lpOverlapped=0x0) returned 1 [0086.112] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.134] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.146] CloseHandle (hObject=0x110) returned 1 [0086.146] CloseHandle (hObject=0x114) returned 1 [0086.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F6D6178696D697A65.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f6d6178696d697a65.png")) returned 0 [0086.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F6D6178696D697A65.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f6d6178696d697a65.png")) returned 0x2020 [0086.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x3300d0, dwReserved1=0x18dfd4, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 0x325118 [0086.148] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x3300d0, dwReserved1=0x18dfd4, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 0 [0086.148] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0086.148] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 1 [0086.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 0xffffffff [0086.149] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 1 [0086.149] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0086.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0086.149] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0086.149] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0086.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.150] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0086.150] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0086.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F70726573736564.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f70726573736564.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0086.151] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0086.151] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0086.151] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0086.243] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0xa0, lpOverlapped=0x0) returned 1 [0086.244] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0xb0, lpOverlapped=0x0) returned 1 [0086.245] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.268] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.279] CloseHandle (hObject=0x114) returned 1 [0086.280] CloseHandle (hObject=0x110) returned 1 [0086.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F70726573736564.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f70726573736564.png")) returned 0 [0086.282] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746F706261725F666C6F6174696E675F627574746F6E5F70726573736564.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\746f706261725f666c6f6174696e675f627574746f6e5f70726573736564.png")) returned 0x2020 [0086.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x3300d0, dwReserved1=0x18dfd4, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0x325118 [0086.282] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x3300d0, dwReserved1=0x18dfd4, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0 [0086.282] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0086.282] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 1 [0086.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 0xffffffff [0086.283] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0 [0086.283] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0086.283] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x676e6974, dwReserved1=0x7475625f, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0086.283] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0086.283] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.283] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0086.283] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0086.284] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0086.284] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.284] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0086.284] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0086.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0086.285] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52a [0086.285] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0086.285] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0086.359] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x52a, lpOverlapped=0x0) returned 1 [0086.360] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x530, lpOverlapped=0x0) returned 1 [0086.361] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.419] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.430] CloseHandle (hObject=0x11c) returned 1 [0086.431] CloseHandle (hObject=0x110) returned 1 [0086.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\6d616e6966657374.json")) returned 0 [0086.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\6d616e6966657374.json")) returned 0x2020 [0086.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0086.433] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0086.433] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0086.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 1 [0086.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 0xffffffff [0086.434] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0086.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120011e, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0086.436] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120011e, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0086.436] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120011e, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0086.436] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0086.436] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0086.436] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0086.436] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0086.436] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.436] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0086.436] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0086.437] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0086.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0086.437] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0086.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0086.438] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x376 [0086.438] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0086.439] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0086.513] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x376, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x376, lpOverlapped=0x0) returned 1 [0086.516] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x380, lpOverlapped=0x0) returned 1 [0086.516] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.539] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.550] CloseHandle (hObject=0x114) returned 1 [0086.551] CloseHandle (hObject=0x118) returned 1 [0086.551] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0086.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0086.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0086.552] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0086.552] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0086.552] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 1 [0086.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0086.553] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0086.553] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0086.553] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0086.553] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0086.554] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0086.554] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0086.554] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0086.554] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.554] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0086.554] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0086.554] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0086.554] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.554] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0086.555] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0086.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0086.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.555] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c1 [0086.555] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0086.556] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0086.645] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2c1, lpOverlapped=0x0) returned 1 [0086.647] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2d0, lpOverlapped=0x0) returned 1 [0086.648] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.671] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.682] CloseHandle (hObject=0x118) returned 1 [0086.683] CloseHandle (hObject=0x114) returned 1 [0086.684] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0086.684] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0086.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0086.684] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0086.684] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0086.684] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 1 [0086.685] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0086.685] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0086.685] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0086.686] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0086.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0086.686] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0086.686] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0086.686] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0086.686] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.686] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0086.686] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0086.687] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0086.687] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.687] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0086.687] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0086.687] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0086.688] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x297 [0086.688] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0086.689] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0086.784] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x297, lpOverlapped=0x0) returned 1 [0086.803] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0086.804] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.833] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.844] CloseHandle (hObject=0x114) returned 1 [0086.844] CloseHandle (hObject=0x118) returned 1 [0086.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0086.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0086.846] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0086.846] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0086.846] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0086.846] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 1 [0086.847] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0086.848] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0086.848] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0086.848] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0086.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0086.848] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0086.848] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0086.848] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0086.848] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.849] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0086.849] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0086.849] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0086.849] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0086.849] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0086.849] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0086.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0086.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.850] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0086.850] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0086.850] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0086.928] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x282, lpOverlapped=0x0) returned 1 [0086.965] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x290, lpOverlapped=0x0) returned 1 [0086.966] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.989] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.000] CloseHandle (hObject=0x118) returned 1 [0087.001] CloseHandle (hObject=0x114) returned 1 [0087.001] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0087.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0087.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0087.002] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.002] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0087.002] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 1 [0087.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 0xffffffff [0087.003] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.003] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0087.003] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0087.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0087.004] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0087.004] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0087.004] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0087.004] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.004] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0087.004] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0087.005] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0087.005] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.005] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0087.005] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0087.005] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.006] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0087.006] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bd [0087.006] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0087.007] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0087.081] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2bd, lpOverlapped=0x0) returned 1 [0087.084] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2c0, lpOverlapped=0x0) returned 1 [0087.085] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.108] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.119] CloseHandle (hObject=0x114) returned 1 [0087.119] CloseHandle (hObject=0x118) returned 1 [0087.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0087.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0087.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0087.121] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.121] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0087.121] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 1 [0087.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 0xffffffff [0087.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.122] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0087.122] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0087.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0087.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0087.122] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0087.123] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0087.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0087.123] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0087.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0087.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0087.123] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0087.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0087.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.124] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36b [0087.124] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0087.124] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0087.213] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x36b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x36b, lpOverlapped=0x0) returned 1 [0087.282] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x370, lpOverlapped=0x0) returned 1 [0087.283] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.305] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.316] CloseHandle (hObject=0x118) returned 1 [0087.317] CloseHandle (hObject=0x114) returned 1 [0087.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0087.318] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0087.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0087.318] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.318] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0087.319] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 1 [0087.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 0xffffffff [0087.320] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.320] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0087.320] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="en", cAlternateFileName="")) returned 1 [0087.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0087.320] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0087.320] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0087.320] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0087.320] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.320] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0087.320] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0087.321] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0087.321] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.321] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0087.321] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0087.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0087.323] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0087.323] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0087.323] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0087.432] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x269, lpOverlapped=0x0) returned 1 [0087.531] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x270, lpOverlapped=0x0) returned 1 [0087.532] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.557] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.568] CloseHandle (hObject=0x114) returned 1 [0087.568] CloseHandle (hObject=0x118) returned 1 [0087.569] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\6d65737361676573.json")) returned 0 [0087.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\6d65737361676573.json")) returned 0x2020 [0087.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0087.570] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.570] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0087.570] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 1 [0087.601] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 0xffffffff [0087.601] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.601] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0087.602] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0087.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0087.602] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0087.602] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0087.603] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0087.603] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.603] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0087.603] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0087.603] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0087.603] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.603] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0087.603] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0087.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0087.604] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.604] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0087.604] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0087.604] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0087.693] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x269, lpOverlapped=0x0) returned 1 [0087.707] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x270, lpOverlapped=0x0) returned 1 [0087.708] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.731] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.743] CloseHandle (hObject=0x118) returned 1 [0087.743] CloseHandle (hObject=0x114) returned 1 [0087.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0 [0087.744] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\6d65737361676573.json")) returned 0x2020 [0087.744] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0087.744] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.745] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0087.745] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 1 [0087.746] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0087.746] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0087.746] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0087.746] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0087.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0087.746] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0087.746] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0087.746] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0087.746] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.746] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0087.747] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0087.747] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0087.747] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0087.747] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0087.747] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0087.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0087.751] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b8 [0087.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0087.751] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0087.840] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2b8, lpOverlapped=0x0) returned 1 [0088.020] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2c0, lpOverlapped=0x0) returned 1 [0088.021] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.044] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.055] CloseHandle (hObject=0x114) returned 1 [0088.055] CloseHandle (hObject=0x118) returned 1 [0088.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0088.057] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0088.057] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0088.057] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.057] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0088.057] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 1 [0088.058] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 0xffffffff [0088.058] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.058] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0088.058] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="es_419", cAlternateFileName="")) returned 1 [0088.058] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0088.059] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0088.059] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0088.059] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0088.059] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.059] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0088.059] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0088.060] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0088.060] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.060] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0088.060] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0088.060] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.060] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0088.060] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0088.060] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0088.061] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0088.095] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x29b, lpOverlapped=0x0) returned 1 [0088.097] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0088.098] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.121] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.132] CloseHandle (hObject=0x118) returned 1 [0088.132] CloseHandle (hObject=0x114) returned 1 [0088.133] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\6d65737361676573.json")) returned 0 [0088.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\6d65737361676573.json")) returned 0x2020 [0088.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0088.134] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.134] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0088.134] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 1 [0088.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0088.135] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.135] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0088.135] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="et", cAlternateFileName="")) returned 1 [0088.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0088.135] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0088.135] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0088.136] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0088.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.136] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0088.136] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0088.136] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0088.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.136] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0088.136] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0088.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0088.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.138] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x261 [0088.138] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0088.138] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0088.170] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x261, lpOverlapped=0x0) returned 1 [0088.172] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x270, lpOverlapped=0x0) returned 1 [0088.173] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.196] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.207] CloseHandle (hObject=0x114) returned 1 [0088.207] CloseHandle (hObject=0x118) returned 1 [0088.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\6d65737361676573.json")) returned 0 [0088.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\6d65737361676573.json")) returned 0x2020 [0088.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0088.209] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.209] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0088.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 1 [0088.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 0xffffffff [0088.210] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.210] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0088.210] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0088.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0088.211] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0088.211] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0088.211] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0088.211] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0088.211] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0088.211] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0088.211] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.212] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0088.212] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0088.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0088.212] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a1 [0088.213] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0088.213] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0088.254] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2a1, lpOverlapped=0x0) returned 1 [0088.256] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2b0, lpOverlapped=0x0) returned 1 [0088.256] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.279] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.291] CloseHandle (hObject=0x118) returned 1 [0088.291] CloseHandle (hObject=0x114) returned 1 [0088.292] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0088.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0088.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0088.293] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.293] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0088.293] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 1 [0088.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0088.294] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.294] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0088.294] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0088.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0088.295] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0088.295] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0088.295] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0088.295] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.295] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0088.295] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0088.295] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0088.295] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.296] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0088.296] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0088.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0088.297] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.297] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b4 [0088.297] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0088.298] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0088.330] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2b4, lpOverlapped=0x0) returned 1 [0088.527] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2c0, lpOverlapped=0x0) returned 1 [0088.530] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.553] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.567] CloseHandle (hObject=0x114) returned 1 [0088.567] CloseHandle (hObject=0x118) returned 1 [0088.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0088.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0088.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0088.573] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.573] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0088.573] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 1 [0088.574] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0088.574] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.574] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0088.574] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0088.574] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0088.575] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0088.575] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0088.577] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0088.578] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.580] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0088.580] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0088.580] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0088.580] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.581] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0088.581] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0088.581] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.581] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0088.582] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c4 [0088.582] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0088.582] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0088.618] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2c4, lpOverlapped=0x0) returned 1 [0088.901] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2d0, lpOverlapped=0x0) returned 1 [0088.902] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.925] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.936] CloseHandle (hObject=0x118) returned 1 [0088.937] CloseHandle (hObject=0x114) returned 1 [0088.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0088.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0088.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0088.938] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.938] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0088.939] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 1 [0088.939] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0088.939] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0088.940] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0088.940] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0088.940] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0088.940] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0088.940] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0088.940] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0088.940] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.940] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0088.940] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0088.941] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0088.941] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0088.941] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0088.941] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0088.941] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0088.942] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.942] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ad [0088.942] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0088.942] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0088.968] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3ad, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3ad, lpOverlapped=0x0) returned 1 [0089.212] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3b0, lpOverlapped=0x0) returned 1 [0089.213] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.235] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.246] CloseHandle (hObject=0x114) returned 1 [0089.247] CloseHandle (hObject=0x118) returned 1 [0089.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0089.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0089.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.248] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.248] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.249] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 1 [0089.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0089.250] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.250] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.250] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="hr", cAlternateFileName="")) returned 1 [0089.250] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.250] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.250] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.250] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.250] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.250] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.250] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.251] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.251] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.251] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.251] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.252] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x279 [0089.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.252] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.277] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x279, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x279, lpOverlapped=0x0) returned 1 [0089.295] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x280, lpOverlapped=0x0) returned 1 [0089.296] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.319] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.330] CloseHandle (hObject=0x118) returned 1 [0089.331] CloseHandle (hObject=0x114) returned 1 [0089.331] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\6d65737361676573.json")) returned 0 [0089.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\6d65737361676573.json")) returned 0x2020 [0089.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.332] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.332] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.332] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 1 [0089.333] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0089.333] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.333] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.335] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0089.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.335] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.335] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.336] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.336] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.336] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.336] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.336] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.336] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.336] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.336] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.337] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c6 [0089.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.338] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.363] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2c6, lpOverlapped=0x0) returned 1 [0089.375] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2d0, lpOverlapped=0x0) returned 1 [0089.376] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.398] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.409] CloseHandle (hObject=0x114) returned 1 [0089.410] CloseHandle (hObject=0x118) returned 1 [0089.410] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0089.411] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0089.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.411] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.411] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.412] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 1 [0089.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0089.413] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.413] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.413] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0089.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.413] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.413] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.413] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.413] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.413] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.414] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.414] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.414] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.414] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.414] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.415] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0089.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.415] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.440] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x269, lpOverlapped=0x0) returned 1 [0089.464] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x270, lpOverlapped=0x0) returned 1 [0089.465] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.488] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.499] CloseHandle (hObject=0x118) returned 1 [0089.499] CloseHandle (hObject=0x114) returned 1 [0089.500] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0089.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0089.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.501] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.501] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.501] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 1 [0089.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 0xffffffff [0089.502] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.502] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.502] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0089.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.503] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.503] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.503] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.503] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.503] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.503] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.503] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.503] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.504] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.507] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26e [0089.507] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.508] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.533] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x26e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x26e, lpOverlapped=0x0) returned 1 [0089.540] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x270, lpOverlapped=0x0) returned 1 [0089.541] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.564] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.577] CloseHandle (hObject=0x114) returned 1 [0089.577] CloseHandle (hObject=0x118) returned 1 [0089.578] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0089.579] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0089.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.579] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.579] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.579] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 1 [0089.580] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 0xffffffff [0089.580] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.581] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.581] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0089.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.581] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.581] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.581] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.581] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.581] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.581] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.582] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.582] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.582] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.582] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.582] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.582] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.583] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30a [0089.583] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.608] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.634] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x30a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x30a, lpOverlapped=0x0) returned 1 [0089.636] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x310, lpOverlapped=0x0) returned 1 [0089.641] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.665] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.677] CloseHandle (hObject=0x118) returned 1 [0089.677] CloseHandle (hObject=0x114) returned 1 [0089.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0089.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0089.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.679] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.679] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.679] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 1 [0089.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0089.680] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.680] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.680] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0089.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.681] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.681] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.681] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.681] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.681] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.681] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.681] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.681] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.681] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.681] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.682] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.686] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.687] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29d [0089.687] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.687] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.713] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29d, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x29d, lpOverlapped=0x0) returned 1 [0089.723] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0089.724] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.747] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.758] CloseHandle (hObject=0x114) returned 1 [0089.759] CloseHandle (hObject=0x118) returned 1 [0089.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0089.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0089.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.760] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.760] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.760] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 1 [0089.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0089.761] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.761] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.762] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0089.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.762] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.762] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.762] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.762] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.762] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.762] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.763] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.763] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.763] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.764] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ae [0089.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.764] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.790] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2ae, lpOverlapped=0x0) returned 1 [0089.792] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2b0, lpOverlapped=0x0) returned 1 [0089.793] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.816] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.827] CloseHandle (hObject=0x118) returned 1 [0089.827] CloseHandle (hObject=0x114) returned 1 [0089.829] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0089.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0089.829] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.829] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.829] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.830] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 1 [0089.831] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0089.831] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.831] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.831] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0089.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.831] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.831] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.831] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.831] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.831] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.831] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.832] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.832] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.832] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.832] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.835] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bb [0089.835] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.835] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.861] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2bb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2bb, lpOverlapped=0x0) returned 1 [0089.862] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2c0, lpOverlapped=0x0) returned 1 [0089.863] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.886] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.898] CloseHandle (hObject=0x114) returned 1 [0089.898] CloseHandle (hObject=0x118) returned 1 [0089.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0089.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0089.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.900] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.900] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.900] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 1 [0089.901] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0089.901] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.901] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.901] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="nb", cAlternateFileName="")) returned 1 [0089.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.902] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.902] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.902] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.902] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.902] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.902] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.902] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.902] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.903] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.903] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.904] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x284 [0089.904] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.904] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.931] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x284, lpOverlapped=0x0) returned 1 [0089.932] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x290, lpOverlapped=0x0) returned 1 [0089.933] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.956] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.967] CloseHandle (hObject=0x118) returned 1 [0089.967] CloseHandle (hObject=0x114) returned 1 [0089.969] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\6d65737361676573.json")) returned 0 [0089.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\6d65737361676573.json")) returned 0x2020 [0089.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0089.969] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.969] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0089.969] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 1 [0089.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 0xffffffff [0089.971] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0089.971] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0089.971] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0089.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0089.971] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0089.971] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0089.971] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0089.971] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.971] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0089.971] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0089.972] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0089.972] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0089.972] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0089.972] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0089.972] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0089.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0089.973] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0089.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0089.974] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0089.999] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x282, lpOverlapped=0x0) returned 1 [0090.001] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x290, lpOverlapped=0x0) returned 1 [0090.002] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.025] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.037] CloseHandle (hObject=0x114) returned 1 [0090.038] CloseHandle (hObject=0x118) returned 1 [0090.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0090.039] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0090.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.039] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.039] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.039] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 1 [0090.040] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0090.040] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.040] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.041] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0090.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.041] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.041] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.041] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.041] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.041] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.041] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.042] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.042] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.042] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.042] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.042] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.042] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.043] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29a [0090.043] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.043] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.069] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x29a, lpOverlapped=0x0) returned 1 [0090.070] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0090.071] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.095] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.106] CloseHandle (hObject=0x118) returned 1 [0090.107] CloseHandle (hObject=0x114) returned 1 [0090.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0090.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0090.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.108] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.108] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.108] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 1 [0090.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0090.109] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.109] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.109] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0090.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.110] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.110] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.110] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.110] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.110] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.111] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.112] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0090.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.112] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.146] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x29b, lpOverlapped=0x0) returned 1 [0090.148] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0090.149] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.172] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.183] CloseHandle (hObject=0x114) returned 1 [0090.183] CloseHandle (hObject=0x118) returned 1 [0090.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0090.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0090.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.185] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.185] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.185] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 1 [0090.186] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0090.186] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.186] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.186] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0090.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.186] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.186] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.187] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.187] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.187] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.187] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.187] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.187] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.187] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.187] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.187] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.188] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x295 [0090.188] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.188] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.221] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x295, lpOverlapped=0x0) returned 1 [0090.225] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0090.227] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.250] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.261] CloseHandle (hObject=0x118) returned 1 [0090.262] CloseHandle (hObject=0x114) returned 1 [0090.262] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0090.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0090.263] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.263] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.263] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.263] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 1 [0090.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0090.265] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.265] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.265] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0090.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.265] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.265] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.266] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.266] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.266] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.266] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.266] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.266] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.266] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.266] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.268] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c [0090.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.268] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.301] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x29c, lpOverlapped=0x0) returned 1 [0090.302] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0090.303] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.327] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.338] CloseHandle (hObject=0x114) returned 1 [0090.338] CloseHandle (hObject=0x118) returned 1 [0090.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0090.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0090.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.340] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.340] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.340] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 1 [0090.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0090.341] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.341] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.341] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0090.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.342] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.342] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.342] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.342] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.342] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.342] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.342] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.342] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.342] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.343] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.343] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30f [0090.344] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.344] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.395] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x30f, lpOverlapped=0x0) returned 1 [0090.396] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x310, lpOverlapped=0x0) returned 1 [0090.397] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.420] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.431] CloseHandle (hObject=0x118) returned 1 [0090.431] CloseHandle (hObject=0x114) returned 1 [0090.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0090.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0090.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.433] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.433] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 1 [0090.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0090.434] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.434] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.434] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0090.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.435] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.435] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.435] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.435] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.435] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.435] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.435] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.435] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.436] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.436] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.454] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29f [0090.454] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.454] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.488] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x29f, lpOverlapped=0x0) returned 1 [0090.490] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2a0, lpOverlapped=0x0) returned 1 [0090.490] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.514] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.525] CloseHandle (hObject=0x114) returned 1 [0090.526] CloseHandle (hObject=0x118) returned 1 [0090.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0090.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0090.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.527] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.527] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 1 [0090.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0090.529] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.529] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.529] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0090.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.529] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.529] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.529] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.530] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.530] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.530] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.531] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0090.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.531] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.564] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x282, lpOverlapped=0x0) returned 1 [0090.566] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x290, lpOverlapped=0x0) returned 1 [0090.567] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.590] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.602] CloseHandle (hObject=0x118) returned 1 [0090.602] CloseHandle (hObject=0x114) returned 1 [0090.603] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0090.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0090.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.604] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.604] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.604] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 1 [0090.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0090.605] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.605] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.605] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0090.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.605] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.605] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.606] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.606] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.606] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.606] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.606] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.606] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.606] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.606] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.608] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32c [0090.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.608] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.642] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x32c, lpOverlapped=0x0) returned 1 [0090.644] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x330, lpOverlapped=0x0) returned 1 [0090.645] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.667] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.679] CloseHandle (hObject=0x114) returned 1 [0090.679] CloseHandle (hObject=0x118) returned 1 [0090.680] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0090.681] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0090.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.681] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.681] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.681] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 1 [0090.682] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0090.682] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.682] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.682] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="sv", cAlternateFileName="")) returned 1 [0090.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.683] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.683] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.683] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.683] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.683] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.683] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.683] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.683] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.683] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.684] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.684] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x289 [0090.684] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.685] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.718] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x289, lpOverlapped=0x0) returned 1 [0090.719] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x290, lpOverlapped=0x0) returned 1 [0090.720] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.743] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.754] CloseHandle (hObject=0x118) returned 1 [0090.755] CloseHandle (hObject=0x114) returned 1 [0090.756] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\6d65737361676573.json")) returned 0 [0090.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\6d65737361676573.json")) returned 0x2020 [0090.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.756] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.756] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.757] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 1 [0090.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0090.757] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.758] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.758] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0090.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.758] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.758] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.758] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.758] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.758] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.758] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.759] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.759] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.759] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.759] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.760] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.760] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44b [0090.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.761] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.793] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x44b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x44b, lpOverlapped=0x0) returned 1 [0090.795] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x450, lpOverlapped=0x0) returned 1 [0090.796] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.819] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.830] CloseHandle (hObject=0x114) returned 1 [0090.830] CloseHandle (hObject=0x118) returned 1 [0090.831] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0090.832] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0090.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.832] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.832] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.832] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 1 [0090.833] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 0xffffffff [0090.833] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.833] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.833] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0090.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.834] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.834] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.834] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.834] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.834] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.834] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.834] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.834] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.834] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.835] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.835] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28a [0090.835] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.836] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.868] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x28a, lpOverlapped=0x0) returned 1 [0090.870] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x290, lpOverlapped=0x0) returned 1 [0090.871] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.893] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.904] CloseHandle (hObject=0x118) returned 1 [0090.905] CloseHandle (hObject=0x114) returned 1 [0090.906] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0090.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0090.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.906] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.906] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.907] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 1 [0090.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0090.908] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.908] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0090.908] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0090.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0090.908] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0090.908] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0090.908] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0090.908] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.908] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0090.908] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0090.909] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0090.909] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0090.909] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0090.909] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0090.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0090.911] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x315 [0090.911] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0090.911] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0090.960] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x315, lpOverlapped=0x0) returned 1 [0090.962] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x320, lpOverlapped=0x0) returned 1 [0090.963] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.986] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.997] CloseHandle (hObject=0x114) returned 1 [0090.997] CloseHandle (hObject=0x118) returned 1 [0090.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0090.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0090.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0090.999] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0090.999] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0090.999] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 1 [0091.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0091.000] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.000] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0091.000] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0091.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0091.000] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0091.000] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0091.001] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.001] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.001] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.001] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.001] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.001] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.001] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.001] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0091.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.002] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d0 [0091.002] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.003] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.038] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x2d0, lpOverlapped=0x0) returned 1 [0091.039] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x2e0, lpOverlapped=0x0) returned 1 [0091.040] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.063] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.074] CloseHandle (hObject=0x118) returned 1 [0091.075] CloseHandle (hObject=0x114) returned 1 [0091.076] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0091.076] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0091.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0091.076] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.076] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0091.076] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 1 [0091.077] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0091.077] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.077] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0091.078] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0091.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0091.078] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0091.078] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0091.078] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.078] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.078] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.078] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.079] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.079] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.079] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.079] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0091.080] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x253 [0091.080] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.080] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.113] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x253, lpOverlapped=0x0) returned 1 [0091.117] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x260, lpOverlapped=0x0) returned 1 [0091.118] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.141] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.152] CloseHandle (hObject=0x114) returned 1 [0091.152] CloseHandle (hObject=0x118) returned 1 [0091.153] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0 [0091.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0x2020 [0091.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0091.154] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.154] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0091.154] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 1 [0091.155] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0091.155] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.155] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0091.155] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0091.155] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0091.156] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0091.156] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0091.156] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.156] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.156] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.156] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.156] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.156] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.156] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.157] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.157] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0091.157] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.157] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x280 [0091.157] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.158] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.192] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x280, lpOverlapped=0x0) returned 1 [0091.193] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x290, lpOverlapped=0x0) returned 1 [0091.194] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.218] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.229] CloseHandle (hObject=0x118) returned 1 [0091.230] CloseHandle (hObject=0x114) returned 1 [0091.231] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0091.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0091.231] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0091.232] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.232] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0091.232] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 1 [0091.233] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0091.233] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.233] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0091.233] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0091.233] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0091.233] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0091.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0091.234] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0091.234] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0091.234] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.234] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.234] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.235] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.235] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2dfa [0091.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.236] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.269] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x2dfa, lpOverlapped=0x0) returned 1 [0091.271] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x2e00, lpOverlapped=0x0) returned 1 [0091.272] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.296] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.307] CloseHandle (hObject=0x11c) returned 1 [0091.307] CloseHandle (hObject=0x114) returned 1 [0091.308] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0091.309] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0091.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0091.309] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0091.309] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0091.309] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 1 [0091.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0091.311] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x1206e6f, dwReserved1=0x31e3e0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0091.311] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0091.311] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0091.311] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0091.311] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 0 [0091.311] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0091.311] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="pjkljhegncpnkpknbcohdijeoejaedia", cAlternateFileName="PJKLJH~1")) returned 1 [0091.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName=".", cAlternateFileName="")) returned 0x325058 [0091.312] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="..", cAlternateFileName="")) returned 1 [0091.312] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="8.1_0", cAlternateFileName="")) returned 1 [0091.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x325098 [0091.314] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0091.314] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0091.315] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.315] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.315] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.315] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.315] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.315] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.315] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.315] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0091.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\313238.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.317] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x180f [0091.317] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.317] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.351] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x180f, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x180f, lpOverlapped=0x0) returned 1 [0091.352] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x1810, lpOverlapped=0x0) returned 1 [0091.354] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.404] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.415] CloseHandle (hObject=0x110) returned 1 [0091.416] CloseHandle (hObject=0x114) returned 1 [0091.417] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\313238.png")) returned 0 [0091.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\313238.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\313238.png")) returned 0x2020 [0091.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="128.png", cAlternateFileName="")) returned 0x3250d8 [0091.417] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="128.png", cAlternateFileName="")) returned 0 [0091.417] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0091.418] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1 [0091.418] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 0xffffffff [0091.418] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0091.419] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.419] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.419] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.419] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.419] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.419] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.419] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.419] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.420] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.420] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0091.420] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x310 [0091.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.420] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.501] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x310, lpOverlapped=0x0) returned 1 [0091.503] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x320, lpOverlapped=0x0) returned 1 [0091.504] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.527] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.538] CloseHandle (hObject=0x114) returned 1 [0091.538] CloseHandle (hObject=0x110) returned 1 [0091.539] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\6d616e6966657374.json")) returned 0 [0091.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\6d616e6966657374.json")) returned 0x2020 [0091.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0091.540] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0091.540] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0091.540] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 1 [0091.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 0xffffffff [0091.541] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0091.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0091.543] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0091.543] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1180116, dwReserved1=0x31e3e0, cFileName="ar", cAlternateFileName="")) returned 1 [0091.543] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0091.544] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0091.544] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0091.544] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.544] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.544] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.544] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.544] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.544] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.544] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.544] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0091.546] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x138 [0091.546] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.546] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.642] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x138, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x138, lpOverlapped=0x0) returned 1 [0091.647] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x140, lpOverlapped=0x0) returned 1 [0091.648] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.673] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.684] CloseHandle (hObject=0x11c) returned 1 [0091.684] CloseHandle (hObject=0x118) returned 1 [0091.685] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\6d65737361676573.json")) returned 0 [0091.685] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\6d65737361676573.json")) returned 0x2020 [0091.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0091.686] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.686] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0091.686] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 1 [0091.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0091.687] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.687] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0091.687] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0091.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0091.687] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0091.687] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0091.688] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.688] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.688] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.688] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.688] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.688] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.688] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.688] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0091.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.689] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124 [0091.689] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.690] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.778] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x124, lpOverlapped=0x0) returned 1 [0091.779] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0091.780] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.803] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.816] CloseHandle (hObject=0x118) returned 1 [0091.816] CloseHandle (hObject=0x11c) returned 1 [0091.817] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0091.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0091.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0091.818] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.818] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0091.818] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 1 [0091.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0091.819] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.819] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0091.819] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0091.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0091.820] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0091.820] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0091.820] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.820] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.820] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.820] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.821] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.821] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.821] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.821] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0091.822] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0091.822] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.822] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0091.901] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfe, lpOverlapped=0x0) returned 1 [0091.902] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0091.903] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.927] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.938] CloseHandle (hObject=0x11c) returned 1 [0091.939] CloseHandle (hObject=0x118) returned 1 [0091.940] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0091.940] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0091.940] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0091.940] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.940] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0091.941] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 1 [0091.941] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0091.942] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0091.942] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0091.942] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0091.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0091.943] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0091.943] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0091.944] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0091.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0091.944] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0091.944] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0091.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0091.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0091.944] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0091.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.946] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0091.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0091.946] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0092.041] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf9, lpOverlapped=0x0) returned 1 [0092.042] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0092.043] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.067] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.078] CloseHandle (hObject=0x118) returned 1 [0092.078] CloseHandle (hObject=0x11c) returned 1 [0092.079] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0092.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0092.080] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0092.080] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.080] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0092.080] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 1 [0092.081] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0092.081] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.081] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0092.081] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0092.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0092.082] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0092.082] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0092.083] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0092.083] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.083] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0092.083] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0092.083] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0092.083] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.083] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0092.083] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.084] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0092.085] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0092.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0092.085] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0092.159] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xec, lpOverlapped=0x0) returned 1 [0092.160] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0092.160] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.183] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.194] CloseHandle (hObject=0x11c) returned 1 [0092.194] CloseHandle (hObject=0x118) returned 1 [0092.195] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0092.196] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0092.196] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0092.196] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.196] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0092.196] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 1 [0092.197] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0092.197] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.197] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0092.197] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0092.197] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0092.199] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0092.199] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0092.199] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0092.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.199] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0092.199] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0092.199] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0092.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.200] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0092.200] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0092.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.200] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef [0092.200] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0092.201] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0092.289] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xef, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xef, lpOverlapped=0x0) returned 1 [0092.290] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0092.291] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.314] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.325] CloseHandle (hObject=0x118) returned 1 [0092.325] CloseHandle (hObject=0x11c) returned 1 [0092.326] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0092.327] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0092.327] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0092.327] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.327] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0092.327] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 1 [0092.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0092.328] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.328] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0092.328] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0092.328] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0092.329] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0092.329] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0092.330] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0092.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0092.330] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0092.330] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0092.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0092.330] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0092.332] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c [0092.332] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0092.332] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0092.426] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x14c, lpOverlapped=0x0) returned 1 [0092.428] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x150, lpOverlapped=0x0) returned 1 [0092.429] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.451] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.462] CloseHandle (hObject=0x11c) returned 1 [0092.462] CloseHandle (hObject=0x118) returned 1 [0092.463] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0092.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0092.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0092.464] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.464] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0092.464] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 1 [0092.465] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0092.465] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.465] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0092.466] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="en", cAlternateFileName="")) returned 1 [0092.466] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0092.466] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0092.466] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0092.466] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0092.466] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.466] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0092.466] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0092.467] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0092.467] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.467] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0092.467] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.467] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0092.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.478] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0092.478] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0092.478] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0092.567] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd7, lpOverlapped=0x0) returned 1 [0092.568] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0092.569] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.591] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.602] CloseHandle (hObject=0x118) returned 1 [0092.603] CloseHandle (hObject=0x11c) returned 1 [0092.604] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\6d65737361676573.json")) returned 0 [0092.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\6d65737361676573.json")) returned 0x2020 [0092.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0092.604] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.604] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0092.605] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 1 [0092.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 0xffffffff [0092.606] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.606] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0092.606] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0092.606] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0092.606] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0092.606] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0092.606] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0092.606] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.606] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0092.606] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0092.607] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0092.607] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.607] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0092.607] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0092.619] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10d [0092.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0092.619] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0092.712] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10d, lpOverlapped=0x0) returned 1 [0092.712] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0092.713] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.736] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.747] CloseHandle (hObject=0x11c) returned 1 [0092.748] CloseHandle (hObject=0x118) returned 1 [0092.749] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0092.749] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0092.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0092.750] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.750] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0092.750] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 1 [0092.751] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0092.751] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.751] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0092.751] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0092.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0092.753] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0092.753] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0092.753] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0092.753] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.753] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0092.753] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0092.754] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0092.754] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.754] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0092.754] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0092.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.755] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0092.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0092.756] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0092.830] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0092.831] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0092.832] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.854] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.865] CloseHandle (hObject=0x118) returned 1 [0092.866] CloseHandle (hObject=0x11c) returned 1 [0092.867] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0092.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0092.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0092.867] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.867] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0092.867] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 1 [0092.868] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0092.868] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.868] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0092.869] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0092.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0092.870] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0092.870] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0092.871] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0092.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0092.871] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0092.871] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0092.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0092.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0092.871] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0092.873] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0092.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0092.873] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0092.961] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xea, lpOverlapped=0x0) returned 1 [0092.962] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0092.963] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.986] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.997] CloseHandle (hObject=0x11c) returned 1 [0092.997] CloseHandle (hObject=0x118) returned 1 [0092.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0092.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0092.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0092.999] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0092.999] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0093.000] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 1 [0093.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0093.001] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.001] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0093.001] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0093.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0093.001] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0093.001] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0093.001] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0093.001] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.002] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0093.002] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0093.002] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0093.002] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.002] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0093.002] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0093.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.003] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c [0093.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0093.003] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0093.091] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10c, lpOverlapped=0x0) returned 1 [0093.092] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0093.093] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.116] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.128] CloseHandle (hObject=0x118) returned 1 [0093.128] CloseHandle (hObject=0x11c) returned 1 [0093.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0093.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0093.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0093.130] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.130] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0093.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 1 [0093.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0093.131] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.131] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0093.131] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0093.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0093.131] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0093.131] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0093.131] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0093.131] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.132] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0093.132] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0093.132] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0093.132] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.132] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0093.132] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0093.133] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121 [0093.133] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0093.133] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0093.206] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x121, lpOverlapped=0x0) returned 1 [0093.207] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0093.207] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.231] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.242] CloseHandle (hObject=0x11c) returned 1 [0093.242] CloseHandle (hObject=0x118) returned 1 [0093.244] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0093.244] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0093.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0093.244] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.244] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0093.245] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 1 [0093.245] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0093.245] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.245] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0093.246] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hr", cAlternateFileName="")) returned 1 [0093.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0093.246] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0093.246] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0093.246] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0093.246] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.246] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0093.246] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0093.247] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0093.247] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.247] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0093.247] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0093.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.248] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0093.248] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0093.248] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0093.338] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe6, lpOverlapped=0x0) returned 1 [0093.339] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0093.340] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.363] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.393] CloseHandle (hObject=0x118) returned 1 [0093.393] CloseHandle (hObject=0x11c) returned 1 [0093.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\6d65737361676573.json")) returned 0 [0093.395] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\6d65737361676573.json")) returned 0x2020 [0093.395] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0093.395] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.395] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0093.395] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 1 [0093.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0093.396] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.396] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0093.397] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0093.397] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0093.397] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0093.397] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0093.397] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0093.397] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.397] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0093.397] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0093.398] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0093.398] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.398] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0093.398] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0093.398] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0093.398] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0093.399] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0093.472] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe2, lpOverlapped=0x0) returned 1 [0093.473] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0093.474] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.496] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.517] CloseHandle (hObject=0x11c) returned 1 [0093.517] CloseHandle (hObject=0x118) returned 1 [0093.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0093.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0093.519] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0093.519] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.519] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0093.519] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 1 [0093.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0093.520] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.520] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0093.520] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0093.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0093.520] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0093.521] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0093.521] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0093.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0093.521] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0093.521] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0093.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0093.521] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0093.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.522] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0093.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0093.523] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0093.679] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf2, lpOverlapped=0x0) returned 1 [0093.680] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0093.680] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.705] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.716] CloseHandle (hObject=0x118) returned 1 [0093.716] CloseHandle (hObject=0x11c) returned 1 [0093.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0093.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0093.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0093.730] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.730] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0093.731] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 1 [0093.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0093.732] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.732] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0093.732] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0093.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0093.732] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0093.732] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0093.732] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0093.732] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.732] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0093.732] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0093.733] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0093.733] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.733] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0093.733] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0093.738] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0093.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0093.738] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0093.833] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0093.834] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0093.835] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.858] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.869] CloseHandle (hObject=0x11c) returned 1 [0093.869] CloseHandle (hObject=0x118) returned 1 [0093.870] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0093.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0093.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0093.871] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.872] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0093.872] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 1 [0093.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0093.873] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.873] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0093.874] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0093.874] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0093.874] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0093.874] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0093.874] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0093.875] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.875] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0093.875] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0093.875] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0093.875] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.875] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0093.875] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0093.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.876] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0093.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0093.876] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0093.951] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x10f, lpOverlapped=0x0) returned 1 [0093.951] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0093.952] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.976] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.987] CloseHandle (hObject=0x118) returned 1 [0093.987] CloseHandle (hObject=0x11c) returned 1 [0093.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0093.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0093.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0093.989] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.989] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0093.989] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 1 [0093.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0093.990] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0093.990] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0093.990] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0093.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0093.990] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0093.990] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0093.991] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0093.991] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.991] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0093.991] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0093.991] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0093.991] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0093.991] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0093.991] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0093.992] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0093.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0093.993] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0094.082] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0094.083] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0094.084] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.107] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.118] CloseHandle (hObject=0x11c) returned 1 [0094.118] CloseHandle (hObject=0x118) returned 1 [0094.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0094.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0094.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0094.121] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.121] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0094.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 1 [0094.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0094.124] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.124] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0094.124] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0094.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0094.124] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0094.124] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0094.125] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0094.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0094.125] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0094.125] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0094.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0094.125] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0094.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0094.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.127] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd [0094.127] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0094.127] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0094.220] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xfd, lpOverlapped=0x0) returned 1 [0094.221] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0094.221] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.244] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.255] CloseHandle (hObject=0x118) returned 1 [0094.256] CloseHandle (hObject=0x11c) returned 1 [0094.257] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0094.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0094.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0094.257] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.257] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0094.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 1 [0094.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0094.259] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.259] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0094.259] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0094.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0094.259] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0094.259] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0094.259] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0094.259] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.259] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0094.259] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0094.260] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0094.260] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.260] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0094.260] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0094.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0094.265] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee [0094.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0094.265] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0094.354] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xee, lpOverlapped=0x0) returned 1 [0094.355] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0094.356] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.389] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.400] CloseHandle (hObject=0x11c) returned 1 [0094.400] CloseHandle (hObject=0x118) returned 1 [0094.401] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0094.402] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0094.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0094.402] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.402] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0094.402] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 1 [0094.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0094.403] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.403] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0094.403] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0094.403] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0094.404] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0094.404] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0094.404] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0094.404] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.404] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0094.404] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0094.404] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0094.404] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.405] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0094.405] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0094.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0094.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.405] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0094.406] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0094.406] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0094.479] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe8, lpOverlapped=0x0) returned 1 [0094.480] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0094.481] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.504] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.532] CloseHandle (hObject=0x118) returned 1 [0094.532] CloseHandle (hObject=0x11c) returned 1 [0094.542] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0094.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0094.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0094.543] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.543] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0094.543] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 1 [0094.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0094.544] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.544] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0094.545] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="no", cAlternateFileName="")) returned 1 [0094.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0094.545] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0094.545] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0094.545] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0094.545] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.545] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0094.546] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0094.546] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0094.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0094.546] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0094.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0094.547] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0094.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0094.548] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0094.663] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd2, lpOverlapped=0x0) returned 1 [0094.664] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0094.666] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.689] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.700] CloseHandle (hObject=0x11c) returned 1 [0094.701] CloseHandle (hObject=0x118) returned 1 [0094.703] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\6d65737361676573.json")) returned 0 [0094.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\6d65737361676573.json")) returned 0x2020 [0094.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0094.704] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.704] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0094.704] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 1 [0094.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0094.705] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.705] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0094.705] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0094.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0094.706] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0094.706] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0094.707] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0094.707] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.707] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0094.707] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0094.707] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0094.707] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.707] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0094.708] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0094.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0094.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.708] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0094.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0094.709] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0094.800] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x108, lpOverlapped=0x0) returned 1 [0094.801] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0094.802] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.839] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.850] CloseHandle (hObject=0x118) returned 1 [0094.851] CloseHandle (hObject=0x11c) returned 1 [0094.852] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0094.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0094.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0094.853] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.853] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0094.853] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 1 [0094.854] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0094.854] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.855] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0094.855] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0094.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0094.857] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0094.857] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0094.857] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0094.857] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.857] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0094.857] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0094.858] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0094.858] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.858] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0094.858] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0094.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0094.859] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0094.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0094.859] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0094.937] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xde, lpOverlapped=0x0) returned 1 [0094.938] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0094.939] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.967] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.982] CloseHandle (hObject=0x11c) returned 1 [0094.982] CloseHandle (hObject=0x118) returned 1 [0094.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0094.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0094.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0094.984] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.984] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0094.984] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0094.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0094.985] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0094.985] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0094.985] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0094.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0094.985] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0094.985] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0094.986] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0094.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0094.986] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0094.986] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0094.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0094.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0094.986] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0094.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0094.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.987] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0094.987] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0094.987] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0095.093] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xdf, lpOverlapped=0x0) returned 1 [0095.094] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0095.095] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.117] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.128] CloseHandle (hObject=0x118) returned 1 [0095.129] CloseHandle (hObject=0x11c) returned 1 [0095.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0095.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0095.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0095.131] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.131] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0095.131] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0095.132] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0095.132] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.132] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0095.132] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0095.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0095.132] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0095.132] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0095.133] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0095.133] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.133] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0095.133] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0095.133] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0095.133] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.133] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0095.133] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0095.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0095.135] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0095.135] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0095.135] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0095.226] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x109, lpOverlapped=0x0) returned 1 [0095.227] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0095.228] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.252] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.265] CloseHandle (hObject=0x11c) returned 1 [0095.265] CloseHandle (hObject=0x118) returned 1 [0095.267] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0095.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0095.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0095.267] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.267] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0095.268] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 1 [0095.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0095.268] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.268] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0095.270] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0095.270] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0095.271] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0095.271] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0095.271] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0095.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0095.271] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0095.271] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0095.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0095.272] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0095.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0095.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.272] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e [0095.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0095.273] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0095.363] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x11e, lpOverlapped=0x0) returned 1 [0095.364] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x120, lpOverlapped=0x0) returned 1 [0095.365] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.402] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.413] CloseHandle (hObject=0x118) returned 1 [0095.413] CloseHandle (hObject=0x11c) returned 1 [0095.414] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0095.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0095.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0095.415] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.415] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0095.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 1 [0095.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0095.416] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.416] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0095.417] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="se", cAlternateFileName="")) returned 1 [0095.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0095.417] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0095.417] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0095.417] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0095.417] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.417] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0095.417] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0095.418] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0095.418] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.418] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0095.418] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0095.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0095.419] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0095.419] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0095.419] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0095.492] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xd2, lpOverlapped=0x0) returned 1 [0095.493] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0095.494] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.517] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.538] CloseHandle (hObject=0x11c) returned 1 [0095.538] CloseHandle (hObject=0x118) returned 1 [0095.539] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\6d65737361676573.json")) returned 0 [0095.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\6d65737361676573.json")) returned 0x2020 [0095.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0095.540] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.540] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0095.540] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 1 [0095.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 0xffffffff [0095.541] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.541] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0095.541] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0095.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0095.542] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0095.542] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0095.542] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0095.542] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.542] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0095.542] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0095.543] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0095.543] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.543] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0095.543] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0095.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0095.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.544] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0095.544] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0095.544] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0095.667] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xde, lpOverlapped=0x0) returned 1 [0095.668] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xe0, lpOverlapped=0x0) returned 1 [0095.669] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.692] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.704] CloseHandle (hObject=0x118) returned 1 [0095.705] CloseHandle (hObject=0x11c) returned 1 [0095.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0095.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0095.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0095.706] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.706] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0095.706] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 1 [0095.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0095.707] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.707] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0095.707] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0095.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0095.708] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0095.708] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0095.708] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0095.708] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.708] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0095.708] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0095.709] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0095.709] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.709] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0095.709] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0095.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0095.710] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0095.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0095.710] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0095.800] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xea, lpOverlapped=0x0) returned 1 [0095.801] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0095.802] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.825] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.836] CloseHandle (hObject=0x11c) returned 1 [0095.836] CloseHandle (hObject=0x118) returned 1 [0095.837] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0095.837] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0095.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0095.838] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.838] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0095.838] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 1 [0095.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0095.839] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.839] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0095.839] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0095.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0095.839] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0095.839] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0095.840] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0095.840] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.840] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0095.840] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0095.840] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0095.840] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.840] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0095.840] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0095.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0095.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.841] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127 [0095.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0095.841] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0095.914] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x127, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x127, lpOverlapped=0x0) returned 1 [0095.915] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0095.916] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.941] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.952] CloseHandle (hObject=0x118) returned 1 [0095.952] CloseHandle (hObject=0x11c) returned 1 [0095.953] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0095.954] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0095.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0095.954] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.954] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0095.954] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 1 [0095.955] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0095.955] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0095.955] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0095.955] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0095.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0095.956] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0095.956] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0095.956] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0095.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0095.956] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0095.956] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0095.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0095.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0095.957] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0095.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0095.957] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144 [0095.957] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0095.958] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0096.056] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x144, lpOverlapped=0x0) returned 1 [0096.057] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x150, lpOverlapped=0x0) returned 1 [0096.058] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.081] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.093] CloseHandle (hObject=0x11c) returned 1 [0096.093] CloseHandle (hObject=0x118) returned 1 [0096.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0096.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0096.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0096.095] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.095] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0096.095] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 1 [0096.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0096.096] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.096] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0096.097] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0096.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0096.097] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0096.097] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0096.097] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0096.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.097] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0096.097] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0096.098] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0096.098] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.098] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0096.098] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0096.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0096.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.099] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0096.099] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0096.099] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0096.187] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xea, lpOverlapped=0x0) returned 1 [0096.188] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0096.189] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.212] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.223] CloseHandle (hObject=0x118) returned 1 [0096.223] CloseHandle (hObject=0x11c) returned 1 [0096.225] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0096.225] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0096.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0096.225] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.225] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0096.225] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 1 [0096.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0096.226] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.226] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0096.227] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0096.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0096.227] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0096.227] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0096.227] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0096.227] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.227] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0096.227] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0096.228] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0096.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0096.228] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0096.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0096.229] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130 [0096.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0096.229] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0096.318] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x130, lpOverlapped=0x0) returned 1 [0096.319] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x140, lpOverlapped=0x0) returned 1 [0096.320] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.343] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.355] CloseHandle (hObject=0x11c) returned 1 [0096.355] CloseHandle (hObject=0x118) returned 1 [0096.356] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0096.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0096.356] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0096.357] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.357] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0096.357] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 1 [0096.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0096.358] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.358] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0096.358] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0096.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0096.358] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0096.358] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0096.358] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0096.359] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.359] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0096.359] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0096.359] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0096.359] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.359] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0096.359] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0096.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0096.360] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.360] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0096.360] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0096.360] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0096.443] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xe8, lpOverlapped=0x0) returned 1 [0096.444] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0xf0, lpOverlapped=0x0) returned 1 [0096.444] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.467] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.479] CloseHandle (hObject=0x118) returned 1 [0096.479] CloseHandle (hObject=0x11c) returned 1 [0096.481] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0096.481] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0096.482] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0096.482] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.482] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0096.482] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 1 [0096.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0096.483] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.483] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0096.483] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0096.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0096.483] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0096.483] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0096.484] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0096.484] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.484] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0096.484] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0096.484] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0096.484] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.484] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0096.484] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0096.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0096.485] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0096.485] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0096.486] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0096.586] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x102, lpOverlapped=0x0) returned 1 [0096.589] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x110, lpOverlapped=0x0) returned 1 [0096.590] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.613] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.624] CloseHandle (hObject=0x11c) returned 1 [0096.624] CloseHandle (hObject=0x118) returned 1 [0096.625] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0 [0096.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\6d65737361676573.json")) returned 0x2020 [0096.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0096.626] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.626] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0096.626] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0096.627] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0096.627] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.627] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0096.627] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0096.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0096.628] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0096.628] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0096.628] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0096.628] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.628] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0096.628] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0096.629] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0096.629] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.629] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0096.629] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0096.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0096.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.630] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0096.630] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0096.630] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0096.718] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0xf9, lpOverlapped=0x0) returned 1 [0096.719] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x100, lpOverlapped=0x0) returned 1 [0096.720] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.743] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.754] CloseHandle (hObject=0x118) returned 1 [0096.756] CloseHandle (hObject=0x11c) returned 1 [0096.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0096.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0096.757] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0096.757] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x330f38, dwReserved1=0x18dd6c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.758] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0096.758] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0096.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0096.759] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0096.759] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0096.759] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0096.759] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0096.759] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0096.759] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0096.760] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0096.760] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0096.760] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0096.760] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.760] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0096.760] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0096.760] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0096.760] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.760] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0096.760] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0096.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0096.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.761] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2686 [0096.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0096.762] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0096.834] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2686, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x2686, lpOverlapped=0x0) returned 1 [0096.836] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2690, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x2690, lpOverlapped=0x0) returned 1 [0096.837] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.860] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.872] CloseHandle (hObject=0x114) returned 1 [0096.872] CloseHandle (hObject=0x11c) returned 1 [0096.873] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0096.874] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0096.874] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0096.874] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0096.874] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0096.874] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 1 [0096.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0096.875] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x1186e6f, dwReserved1=0x31e3e0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0096.875] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0096.875] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0096.875] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0096.875] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="8.1_0", cAlternateFileName="")) returned 0 [0096.876] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0096.876] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0096.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName=".", cAlternateFileName="")) returned 0x325058 [0096.877] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="..", cAlternateFileName="")) returned 1 [0096.877] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1 [0096.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x325098 [0096.879] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0096.879] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="angular.js", cAlternateFileName="")) returned 1 [0096.880] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0096.880] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.880] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0096.880] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0096.880] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0096.880] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0096.880] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0096.880] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0096.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0096.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\616E67756C6172.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\616e67756c6172.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.882] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c0bf [0096.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0096.882] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0096.971] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8c0bf, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x8c0bf, lpOverlapped=0x0) returned 1 [0096.986] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8c0c0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x8c0c0, lpOverlapped=0x0) returned 1 [0096.997] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.020] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.031] CloseHandle (hObject=0x110) returned 1 [0097.031] CloseHandle (hObject=0x11c) returned 1 [0097.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\616E67756C6172.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\616e67756c6172.js")) returned 0 [0097.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\616E67756C6172.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\616e67756c6172.js")) returned 0x2020 [0097.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="angular.js", cAlternateFileName="")) returned 0x3250d8 [0097.039] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="angular.js", cAlternateFileName="")) returned 0 [0097.039] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0097.039] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 1 [0097.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 0xffffffff [0097.044] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1 [0097.044] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0097.045] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.045] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0097.045] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0097.045] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0097.045] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.045] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0097.045] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0097.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6261636B67726F756E645F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6261636b67726f756e645f736372697074.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0097.047] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa89c [0097.047] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0097.047] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0097.142] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa89c, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xa89c, lpOverlapped=0x0) returned 1 [0097.156] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa8a0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xa8a0, lpOverlapped=0x0) returned 1 [0097.160] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.183] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.198] CloseHandle (hObject=0x11c) returned 1 [0097.198] CloseHandle (hObject=0x110) returned 1 [0097.202] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6261636B67726F756E645F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6261636b67726f756e645f736372697074.js")) returned 0 [0097.203] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6261636B67726F756E645F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6261636b67726f756e645f736372697074.js")) returned 0x2020 [0097.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 0x3250d8 [0097.203] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 0 [0097.203] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0097.203] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 1 [0097.204] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 0xffffffff [0097.204] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1 [0097.207] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0097.207] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.210] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0097.210] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0097.210] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0097.210] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.210] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0097.210] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0097.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0097.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F67616D655F73656E646572.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f67616d655f73656e646572.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.211] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x181aa [0097.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0097.211] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0097.300] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x181aa, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x181aa, lpOverlapped=0x0) returned 1 [0097.303] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x181b0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x181b0, lpOverlapped=0x0) returned 1 [0097.306] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.329] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.341] CloseHandle (hObject=0x110) returned 1 [0097.341] CloseHandle (hObject=0x11c) returned 1 [0097.343] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F67616D655F73656E646572.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f67616d655f73656e646572.js")) returned 0 [0097.343] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F67616D655F73656E646572.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f67616d655f73656e646572.js")) returned 0x2020 [0097.344] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 0x3250d8 [0097.344] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 0 [0097.344] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0097.344] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 1 [0097.345] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 0xffffffff [0097.345] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1 [0097.346] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0097.346] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.346] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0097.346] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0097.346] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0097.346] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.346] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0097.346] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0097.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F726F7574655F64657461696C73.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f726f7574655f64657461696c73.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0097.347] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111e1 [0097.347] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0097.348] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0097.438] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x111e1, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x111e1, lpOverlapped=0x0) returned 1 [0097.441] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x111f0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x111f0, lpOverlapped=0x0) returned 1 [0097.443] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.467] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.478] CloseHandle (hObject=0x11c) returned 1 [0097.478] CloseHandle (hObject=0x110) returned 1 [0097.480] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F726F7574655F64657461696C73.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f726f7574655f64657461696c73.html")) returned 0 [0097.480] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F726F7574655F64657461696C73.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f726f7574655f64657461696c73.html")) returned 0x2020 [0097.481] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 0x3250d8 [0097.481] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 0 [0097.481] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0097.481] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 1 [0097.482] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 0xffffffff [0097.482] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1 [0097.482] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0097.482] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.483] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0097.483] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0097.483] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0097.483] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.483] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0097.483] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0097.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0097.484] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F726F7574655F64657461696C73.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f726f7574655f64657461696c73.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.484] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a258 [0097.484] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0097.484] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0097.599] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3a258, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x3a258, lpOverlapped=0x0) returned 1 [0097.613] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3a260, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x3a260, lpOverlapped=0x0) returned 1 [0097.618] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.641] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.652] CloseHandle (hObject=0x110) returned 1 [0097.652] CloseHandle (hObject=0x11c) returned 1 [0097.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F726F7574655F64657461696C73.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f726f7574655f64657461696c73.js")) returned 0 [0097.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F726F7574655F64657461696C73.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f726f7574655f64657461696c73.js")) returned 0x2020 [0097.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 0x3250d8 [0097.656] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 0 [0097.656] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0097.656] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 1 [0097.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 0xffffffff [0097.658] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1 [0097.658] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0097.658] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.659] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0097.659] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0097.659] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0097.659] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.659] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0097.659] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0097.659] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.660] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F73656E646572.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f73656e646572.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0097.661] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce17 [0097.661] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0097.661] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0097.750] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce17, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xce17, lpOverlapped=0x0) returned 1 [0097.752] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xce20, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xce20, lpOverlapped=0x0) returned 1 [0097.754] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.777] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.789] CloseHandle (hObject=0x11c) returned 1 [0097.789] CloseHandle (hObject=0x110) returned 1 [0097.791] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F73656E646572.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f73656e646572.js")) returned 0 [0097.791] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745F73656E646572.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636173745f73656e646572.js")) returned 0x2020 [0097.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 0x3250d8 [0097.791] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x32ef28, dwReserved1=0x18e23c, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 0 [0097.791] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0097.792] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 1 [0097.793] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 0xffffffff [0097.793] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1 [0097.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c012a, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0097.794] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c012a, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0097.794] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x12c012a, dwReserved1=0x31e3e0, cFileName="cast_app.css", cAlternateFileName="")) returned 1 [0097.795] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0097.795] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.795] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0097.795] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0097.795] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0097.795] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.795] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0097.795] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0097.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F617070.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f617070.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0097.796] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a1d [0097.796] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0097.799] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0097.873] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a1d, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x1a1d, lpOverlapped=0x0) returned 1 [0097.875] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x1a20, lpOverlapped=0x0) returned 1 [0097.876] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.899] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.910] CloseHandle (hObject=0x11c) returned 1 [0097.910] CloseHandle (hObject=0x114) returned 1 [0097.911] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F617070.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f617070.css")) returned 0 [0097.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F617070.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f617070.css")) returned 0x2020 [0097.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="cast_app.css", cAlternateFileName="")) returned 0x325118 [0097.912] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="cast_app.css", cAlternateFileName="")) returned 0 [0097.912] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0097.912] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 1 [0097.913] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 0xffffffff [0097.913] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="cast_app.js", cAlternateFileName="")) returned 1 [0097.914] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0097.914] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.914] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0097.914] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0097.914] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0097.914] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0097.914] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0097.914] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0097.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0097.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F617070.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f617070.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.915] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x221da [0097.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0097.915] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0098.006] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x221da, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x221da, lpOverlapped=0x0) returned 1 [0098.010] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x221e0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x221e0, lpOverlapped=0x0) returned 1 [0098.013] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.036] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.047] CloseHandle (hObject=0x114) returned 1 [0098.047] CloseHandle (hObject=0x11c) returned 1 [0098.049] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F617070.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f617070.js")) returned 0 [0098.050] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F617070.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f617070.js")) returned 0x2020 [0098.050] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="cast_app.js", cAlternateFileName="")) returned 0x325118 [0098.050] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="cast_app.js", cAlternateFileName="")) returned 0 [0098.050] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0098.050] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 1 [0098.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 0xffffffff [0098.052] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 1 [0098.052] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0098.052] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.052] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0098.052] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0098.053] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0098.053] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.053] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0098.053] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0098.053] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0098.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F6170705F7265646972656374.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f6170705f7265646972656374.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0098.055] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0098.055] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0098.055] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0098.145] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0xf2, lpOverlapped=0x0) returned 1 [0098.146] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x100, lpOverlapped=0x0) returned 1 [0098.147] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.170] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.181] CloseHandle (hObject=0x11c) returned 1 [0098.182] CloseHandle (hObject=0x114) returned 1 [0098.183] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F6170705F7265646972656374.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f6170705f7265646972656374.js")) returned 0 [0098.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745F6170705F7265646972656374.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\636173745f6170705f7265646972656374.js")) returned 0x2020 [0098.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 0x325118 [0098.183] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x32ff30, dwReserved1=0x18dfd4, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 0 [0098.183] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0098.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 1 [0098.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 0xffffffff [0098.185] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0098.185] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0098.185] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.185] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0098.185] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0098.185] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0098.185] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.185] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0098.185] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0098.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0098.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6368726F6D65636173745F6C6F676F5F67726579.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6368726f6d65636173745f6c6f676f5f67726579.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0098.186] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bef [0098.187] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0098.187] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0098.275] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1bef, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x1bef, lpOverlapped=0x0) returned 1 [0098.277] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1bf0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x1bf0, lpOverlapped=0x0) returned 1 [0098.278] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.303] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.314] CloseHandle (hObject=0x114) returned 1 [0098.314] CloseHandle (hObject=0x11c) returned 1 [0098.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6368726F6D65636173745F6C6F676F5F67726579.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6368726f6d65636173745f6c6f676f5f67726579.png")) returned 0 [0098.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6368726F6D65636173745F6C6F676F5F67726579.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6368726f6d65636173745f6c6f676f5f67726579.png")) returned 0x2020 [0098.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 0x325118 [0098.316] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 0 [0098.316] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0098.316] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 1 [0098.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 0xffffffff [0098.317] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 1 [0098.317] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0098.317] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.317] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0098.317] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0098.318] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0098.318] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.318] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0098.318] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0098.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0098.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\64657669636573.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\64657669636573.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0098.319] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0098.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0098.319] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0098.410] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x3b, lpOverlapped=0x0) returned 1 [0098.411] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x40, lpOverlapped=0x0) returned 1 [0098.412] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.434] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.446] CloseHandle (hObject=0x11c) returned 1 [0098.446] CloseHandle (hObject=0x114) returned 1 [0098.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\64657669636573.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\64657669636573.html")) returned 0 [0098.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\64657669636573.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\64657669636573.html")) returned 0x2020 [0098.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 0x325118 [0098.448] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 0 [0098.448] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0098.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 1 [0098.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 0xffffffff [0098.449] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0098.449] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0098.449] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.449] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0098.450] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0098.450] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0098.450] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.450] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0098.450] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0098.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0098.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\696E646578.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\696e646578.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0098.451] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x828 [0098.451] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0098.451] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0098.550] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x828, lpOverlapped=0x0) returned 1 [0098.560] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x830, lpOverlapped=0x0) returned 1 [0098.561] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.585] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.596] CloseHandle (hObject=0x114) returned 1 [0098.596] CloseHandle (hObject=0x11c) returned 1 [0098.597] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\696E646578.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\696e646578.html")) returned 0 [0098.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\696E646578.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\696e646578.html")) returned 0x2020 [0098.598] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 0x325118 [0098.598] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 0 [0098.598] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0098.598] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 1 [0098.599] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 0xffffffff [0098.599] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 1 [0098.599] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0098.599] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.599] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0098.599] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0098.600] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0098.600] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.600] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0098.600] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0098.600] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0098.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6F6666657273.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6f6666657273.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0098.602] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0098.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0098.602] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0098.683] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x3b, lpOverlapped=0x0) returned 1 [0098.684] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x40, lpOverlapped=0x0) returned 1 [0098.686] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.709] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.720] CloseHandle (hObject=0x11c) returned 1 [0098.721] CloseHandle (hObject=0x114) returned 1 [0098.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6F6666657273.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6f6666657273.html")) returned 0 [0098.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6F6666657273.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\6f6666657273.html")) returned 0x2020 [0098.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 0x325118 [0098.723] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 0 [0098.723] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0098.723] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 1 [0098.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 0xffffffff [0098.724] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 1 [0098.724] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0098.724] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.724] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0098.724] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0098.725] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0098.725] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.725] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0098.725] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0098.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0098.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\7365747570.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\7365747570.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0098.726] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0098.726] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0098.726] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0098.828] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x3b, lpOverlapped=0x0) returned 1 [0098.829] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x40, lpOverlapped=0x0) returned 1 [0098.830] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.855] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.866] CloseHandle (hObject=0x114) returned 1 [0098.867] CloseHandle (hObject=0x11c) returned 1 [0098.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\7365747570.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\7365747570.html")) returned 0 [0098.868] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\7365747570.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\7365747570.html")) returned 0x2020 [0098.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0x325118 [0098.869] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0 [0098.869] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0098.869] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 1 [0098.870] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 0xffffffff [0098.870] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0 [0098.870] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0098.870] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1 [0098.870] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0098.870] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="..", cAlternateFileName="")) returned 1 [0098.870] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1 [0098.871] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0098.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0098.871] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0098.871] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0098.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0098.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0098.871] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0098.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0098.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0098.872] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x174c [0098.872] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0098.872] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0098.965] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x174c, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x174c, lpOverlapped=0x0) returned 1 [0098.967] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x1750, lpOverlapped=0x0) returned 1 [0098.968] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.991] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.002] CloseHandle (hObject=0x11c) returned 1 [0099.002] CloseHandle (hObject=0x114) returned 1 [0099.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.html")) returned 0 [0099.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.html")) returned 0x2020 [0099.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 0x325118 [0099.004] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x331f30, dwReserved1=0x18dfd4, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 0 [0099.004] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0099.004] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 1 [0099.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 0xffffffff [0099.006] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="view.js", cAlternateFileName="")) returned 1 [0099.006] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0099.006] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.006] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0099.006] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0099.007] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0099.007] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.007] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0099.007] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0099.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0099.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0099.008] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x945 [0099.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0099.009] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0099.097] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x945, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x945, lpOverlapped=0x0) returned 1 [0099.101] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x950, lpOverlapped=0x0) returned 1 [0099.102] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.125] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.136] CloseHandle (hObject=0x114) returned 1 [0099.136] CloseHandle (hObject=0x11c) returned 1 [0099.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.js")) returned 0 [0099.138] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\76696577.js")) returned 0x2020 [0099.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="view.js", cAlternateFileName="")) returned 0x325118 [0099.138] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="view.js", cAlternateFileName="")) returned 0 [0099.138] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0099.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 1 [0099.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 0xffffffff [0099.140] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="view.js", cAlternateFileName="")) returned 0 [0099.140] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0099.140] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="common.js", cAlternateFileName="")) returned 1 [0099.140] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0099.140] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.140] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0099.140] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0099.141] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0099.141] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.141] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0099.141] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0099.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0099.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636F6D6D6F6E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636f6d6d6f6e.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0099.142] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc878 [0099.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0099.142] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0099.215] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc878, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xc878, lpOverlapped=0x0) returned 1 [0099.224] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xc880, lpOverlapped=0x0) returned 1 [0099.226] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.248] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.260] CloseHandle (hObject=0x110) returned 1 [0099.260] CloseHandle (hObject=0x11c) returned 1 [0099.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636F6D6D6F6E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636f6d6d6f6e.js")) returned 0 [0099.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636F6D6D6F6E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\636f6d6d6f6e.js")) returned 0x2020 [0099.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="common.js", cAlternateFileName="")) returned 0x3250d8 [0099.262] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="common.js", cAlternateFileName="")) returned 0 [0099.262] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0099.262] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 1 [0099.264] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 0xffffffff [0099.264] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="feedback.css", cAlternateFileName="")) returned 1 [0099.264] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0099.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0099.264] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0099.264] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0099.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0099.264] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0099.265] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0099.265] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0099.265] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc26 [0099.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0099.266] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0099.358] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc26, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0xc26, lpOverlapped=0x0) returned 1 [0099.361] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0xc30, lpOverlapped=0x0) returned 1 [0099.362] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.402] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.413] CloseHandle (hObject=0x11c) returned 1 [0099.414] CloseHandle (hObject=0x110) returned 1 [0099.415] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b.css")) returned 0 [0099.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b.css")) returned 0x2020 [0099.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="feedback.css", cAlternateFileName="")) returned 0x3250d8 [0099.416] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="feedback.css", cAlternateFileName="")) returned 0 [0099.416] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0099.416] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 1 [0099.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 0xffffffff [0099.417] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1 [0099.417] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0099.417] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.417] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0099.417] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0099.417] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0099.418] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.418] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0099.418] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0099.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0099.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0099.418] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38a8 [0099.419] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0099.419] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0099.491] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x38a8, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x38a8, lpOverlapped=0x0) returned 1 [0099.502] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x38b0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x38b0, lpOverlapped=0x0) returned 1 [0099.507] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.530] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.541] CloseHandle (hObject=0x110) returned 1 [0099.542] CloseHandle (hObject=0x11c) returned 1 [0099.543] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b.html")) returned 0 [0099.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b.html")) returned 0x2020 [0099.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 0x3250d8 [0099.544] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 0 [0099.544] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0099.544] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 1 [0099.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 0xffffffff [0099.545] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1 [0099.545] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0099.545] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0099.546] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0099.546] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0099.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0099.546] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0099.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0099.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B5F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b5f736372697074.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0099.548] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b20 [0099.548] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0099.548] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0099.651] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b20, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x2b20, lpOverlapped=0x0) returned 1 [0099.653] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x2b30, lpOverlapped=0x0) returned 1 [0099.654] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.677] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.688] CloseHandle (hObject=0x11c) returned 1 [0099.688] CloseHandle (hObject=0x110) returned 1 [0099.689] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B5F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b5f736372697074.js")) returned 0 [0099.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636B5F736372697074.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\666565646261636b5f736372697074.js")) returned 0x2020 [0099.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 0x3250d8 [0099.690] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 0 [0099.690] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0099.690] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 1 [0099.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 0xffffffff [0099.691] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0099.692] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0099.692] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.692] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0099.692] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0099.692] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0099.692] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.692] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0099.692] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0099.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0099.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d616e6966657374.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0099.693] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f8 [0099.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0099.693] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0099.782] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x8f8, lpOverlapped=0x0) returned 1 [0099.783] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x900, lpOverlapped=0x0) returned 1 [0099.784] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.807] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.819] CloseHandle (hObject=0x110) returned 1 [0099.819] CloseHandle (hObject=0x11c) returned 1 [0099.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d616e6966657374.json")) returned 0 [0099.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D616E6966657374.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d616e6966657374.json")) returned 0x2020 [0099.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x3250d8 [0099.821] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0099.821] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0099.821] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json")) returned 1 [0099.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json")) returned 0xffffffff [0099.822] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1 [0099.823] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0099.823] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.823] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0099.823] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0099.823] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0099.823] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.823] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0099.823] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0099.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0099.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6174657269616C5F6373735F6D696E.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6174657269616c5f6373735f6d696e.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0099.824] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46039 [0099.824] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0099.824] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0099.913] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x46039, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x46039, lpOverlapped=0x0) returned 1 [0099.923] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x46040, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x46040, lpOverlapped=0x0) returned 1 [0099.929] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.951] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.962] CloseHandle (hObject=0x11c) returned 1 [0099.963] CloseHandle (hObject=0x110) returned 1 [0099.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6174657269616C5F6373735F6D696E.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6174657269616c5f6373735f6d696e.css")) returned 0 [0099.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6174657269616C5F6373735F6D696E.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6174657269616c5f6373735f6d696e.css")) returned 0x2020 [0099.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 0x3250d8 [0099.967] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 0 [0099.967] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0099.967] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 1 [0099.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 0xffffffff [0099.970] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1 [0099.970] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0099.970] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.970] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0099.970] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0099.971] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0099.971] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0099.971] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0099.971] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0099.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0099.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F636173745F73747265616D696E67.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f636173745f73747265616d696e67.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0099.972] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c33 [0099.972] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0099.972] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0100.046] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7c33, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x7c33, lpOverlapped=0x0) returned 1 [0100.052] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7c40, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x7c40, lpOverlapped=0x0) returned 1 [0100.053] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.076] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.087] CloseHandle (hObject=0x110) returned 1 [0100.087] CloseHandle (hObject=0x11c) returned 1 [0100.089] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F636173745F73747265616D696E67.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f636173745f73747265616d696e67.js")) returned 0 [0100.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F636173745F73747265616D696E67.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f636173745f73747265616d696e67.js")) returned 0x2020 [0100.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 0x3250d8 [0100.089] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 0 [0100.089] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0100.089] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 1 [0100.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 0xffffffff [0100.091] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1 [0100.091] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0100.091] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.091] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0100.091] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0100.091] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0100.091] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.091] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0100.092] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0100.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0100.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F636F6D6D6F6E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f636f6d6d6f6e.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0100.092] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2adeb [0100.092] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0100.093] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0100.181] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2adeb, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x2adeb, lpOverlapped=0x0) returned 1 [0100.185] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2adf0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x2adf0, lpOverlapped=0x0) returned 1 [0100.189] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.211] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.223] CloseHandle (hObject=0x11c) returned 1 [0100.223] CloseHandle (hObject=0x110) returned 1 [0100.225] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F636F6D6D6F6E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f636f6d6d6f6e.js")) returned 0 [0100.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F636F6D6D6F6E.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f636f6d6d6f6e.js")) returned 0x2020 [0100.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 0x3250d8 [0100.226] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 0 [0100.226] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0100.226] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 1 [0100.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 0xffffffff [0100.228] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1 [0100.228] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0100.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0100.228] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0100.229] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0100.229] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0100.229] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0100.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0100.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F68616E676F757473.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f68616e676f757473.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0100.231] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x794cf [0100.232] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0100.232] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0100.321] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x794cf, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x794cf, lpOverlapped=0x0) returned 1 [0100.334] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x794d0, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x794d0, lpOverlapped=0x0) returned 1 [0100.343] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.383] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.394] CloseHandle (hObject=0x110) returned 1 [0100.394] CloseHandle (hObject=0x11c) returned 1 [0100.399] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F68616E676F757473.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f68616e676f757473.js")) returned 0 [0100.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F68616E676F757473.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f68616e676f757473.js")) returned 0x2020 [0100.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 0x3250d8 [0100.399] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 0 [0100.400] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0100.400] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 1 [0100.404] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 0xffffffff [0100.404] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1 [0100.404] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0100.404] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.404] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0100.404] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0100.405] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0100.405] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.405] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0100.405] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0100.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0100.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F776562727463.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f776562727463.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0100.406] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x941 [0100.406] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0100.406] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0100.486] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x941, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e1c8*=0x941, lpOverlapped=0x0) returned 1 [0100.488] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e1c8*=0x950, lpOverlapped=0x0) returned 1 [0100.489] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.512] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.523] CloseHandle (hObject=0x11c) returned 1 [0100.523] CloseHandle (hObject=0x110) returned 1 [0100.525] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F776562727463.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f776562727463.js")) returned 0 [0100.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6D6972726F72696E675F776562727463.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\6d6972726f72696e675f776562727463.js")) returned 0x2020 [0100.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 0x3250d8 [0100.525] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 0 [0100.525] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0100.525] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 1 [0100.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 0xffffffff [0100.526] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_locales", cAlternateFileName="")) returned 1 [0100.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1360134, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0100.528] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1360134, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0100.529] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1360134, dwReserved1=0x31e3e0, cFileName="am", cAlternateFileName="")) returned 1 [0100.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325118 [0100.529] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0100.529] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0100.529] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0100.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.529] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0100.529] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0100.530] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0100.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0100.530] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0100.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0100.533] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0100.534] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4827 [0100.534] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0100.534] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0100.633] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4827, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x4827, lpOverlapped=0x0) returned 1 [0100.634] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4830, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4830, lpOverlapped=0x0) returned 1 [0100.636] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.659] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.670] CloseHandle (hObject=0x114) returned 1 [0100.670] CloseHandle (hObject=0x118) returned 1 [0100.671] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\6d65737361676573.json")) returned 0 [0100.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\6d65737361676573.json")) returned 0x2020 [0100.672] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0100.672] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0100.672] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0100.672] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json")) returned 1 [0100.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json")) returned 0xffffffff [0100.673] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0100.673] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0100.673] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ar", cAlternateFileName="")) returned 1 [0100.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0100.674] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0100.674] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0100.674] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0100.674] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.674] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0100.674] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0100.675] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0100.675] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.675] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0100.675] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0100.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0100.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0100.676] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45bf [0100.676] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0100.676] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0100.774] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x45bf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x45bf, lpOverlapped=0x0) returned 1 [0100.776] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x45c0, lpOverlapped=0x0) returned 1 [0100.777] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.800] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.811] CloseHandle (hObject=0x118) returned 1 [0100.811] CloseHandle (hObject=0x114) returned 1 [0100.812] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\6d65737361676573.json")) returned 0 [0100.813] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\6d65737361676573.json")) returned 0x2020 [0100.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0100.813] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0100.813] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0100.813] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json")) returned 1 [0100.814] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0100.814] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0100.814] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0100.815] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="bg", cAlternateFileName="")) returned 1 [0100.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0100.815] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0100.816] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0100.816] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0100.816] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.816] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0100.816] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0100.816] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0100.816] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.816] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0100.816] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0100.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0100.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0100.818] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b63 [0100.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0100.818] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0100.892] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4b63, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x4b63, lpOverlapped=0x0) returned 1 [0100.894] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4b70, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4b70, lpOverlapped=0x0) returned 1 [0100.895] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.920] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.931] CloseHandle (hObject=0x114) returned 1 [0100.932] CloseHandle (hObject=0x118) returned 1 [0100.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\6d65737361676573.json")) returned 0 [0100.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\6d65737361676573.json")) returned 0x2020 [0100.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0100.933] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0100.933] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0100.934] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json")) returned 1 [0100.935] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0100.935] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0100.935] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0100.935] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="bn", cAlternateFileName="")) returned 1 [0100.935] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0100.935] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0100.935] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0100.935] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0100.936] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.936] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0100.936] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0100.936] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0100.936] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0100.936] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0100.936] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0100.936] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0100.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0100.937] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52cb [0100.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0100.937] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0101.028] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x52cb, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x52cb, lpOverlapped=0x0) returned 1 [0101.031] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x52d0, lpOverlapped=0x0) returned 1 [0101.033] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.063] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.077] CloseHandle (hObject=0x118) returned 1 [0101.077] CloseHandle (hObject=0x114) returned 1 [0101.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\6d65737361676573.json")) returned 0 [0101.079] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\6d65737361676573.json")) returned 0x2020 [0101.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0101.079] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.079] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0101.080] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json")) returned 1 [0101.081] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json")) returned 0xffffffff [0101.081] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.081] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0101.082] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ca", cAlternateFileName="")) returned 1 [0101.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0101.082] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0101.082] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0101.082] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0101.082] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.082] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0101.082] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0101.083] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0101.083] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.083] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0101.083] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0101.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.085] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0101.085] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x405d [0101.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0101.085] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0101.178] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x405d, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x405d, lpOverlapped=0x0) returned 1 [0101.180] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4060, lpOverlapped=0x0) returned 1 [0101.182] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.204] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.216] CloseHandle (hObject=0x114) returned 1 [0101.216] CloseHandle (hObject=0x118) returned 1 [0101.217] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\6d65737361676573.json")) returned 0 [0101.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\6d65737361676573.json")) returned 0x2020 [0101.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0101.218] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.218] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0101.218] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json")) returned 1 [0101.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0101.219] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.219] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0101.220] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="cs", cAlternateFileName="")) returned 1 [0101.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0101.220] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0101.220] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0101.220] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0101.220] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.220] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0101.220] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0101.221] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0101.221] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.221] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0101.221] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0101.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0101.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.222] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4029 [0101.222] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0101.222] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0101.311] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4029, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x4029, lpOverlapped=0x0) returned 1 [0101.316] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4030, lpOverlapped=0x0) returned 1 [0101.317] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.340] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.352] CloseHandle (hObject=0x118) returned 1 [0101.352] CloseHandle (hObject=0x114) returned 1 [0101.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\6d65737361676573.json")) returned 0 [0101.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\6d65737361676573.json")) returned 0x2020 [0101.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0101.354] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.354] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0101.354] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json")) returned 1 [0101.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0101.355] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.355] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0101.355] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="da", cAlternateFileName="")) returned 1 [0101.355] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0101.356] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0101.356] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0101.356] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0101.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0101.356] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0101.356] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0101.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0101.357] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0101.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0101.359] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f79 [0101.359] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0101.360] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0101.442] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3f79, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3f79, lpOverlapped=0x0) returned 1 [0101.446] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f80, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3f80, lpOverlapped=0x0) returned 1 [0101.447] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.470] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.481] CloseHandle (hObject=0x114) returned 1 [0101.482] CloseHandle (hObject=0x118) returned 1 [0101.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\6d65737361676573.json")) returned 0 [0101.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\6d65737361676573.json")) returned 0x2020 [0101.484] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0101.484] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.484] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0101.484] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json")) returned 1 [0101.486] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json")) returned 0xffffffff [0101.486] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.487] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0101.487] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="de", cAlternateFileName="")) returned 1 [0101.487] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0101.487] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0101.487] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0101.488] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0101.488] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.488] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0101.488] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0101.488] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0101.488] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.488] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0101.488] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0101.489] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0101.489] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.489] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x406f [0101.489] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0101.490] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0101.622] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x406f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x406f, lpOverlapped=0x0) returned 1 [0101.624] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4070, lpOverlapped=0x0) returned 1 [0101.625] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.650] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.661] CloseHandle (hObject=0x118) returned 1 [0101.661] CloseHandle (hObject=0x114) returned 1 [0101.662] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\6d65737361676573.json")) returned 0 [0101.663] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\6d65737361676573.json")) returned 0x2020 [0101.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0101.663] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.663] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0101.663] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json")) returned 1 [0101.665] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json")) returned 0xffffffff [0101.665] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.665] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0101.665] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="el", cAlternateFileName="")) returned 1 [0101.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0101.665] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0101.665] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0101.666] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0101.666] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.666] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0101.666] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0101.666] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0101.666] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.666] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0101.666] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0101.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.673] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0101.674] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4afe [0101.674] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0101.674] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0101.781] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4afe, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x4afe, lpOverlapped=0x0) returned 1 [0101.783] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4b00, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4b00, lpOverlapped=0x0) returned 1 [0101.785] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.808] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.819] CloseHandle (hObject=0x114) returned 1 [0101.820] CloseHandle (hObject=0x118) returned 1 [0101.821] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\6d65737361676573.json")) returned 0 [0101.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\6d65737361676573.json")) returned 0x2020 [0101.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0101.821] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.822] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0101.822] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json")) returned 1 [0101.823] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json")) returned 0xffffffff [0101.823] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.823] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0101.823] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="en", cAlternateFileName="")) returned 1 [0101.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0101.823] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0101.823] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0101.824] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0101.824] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.824] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0101.824] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0101.824] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0101.824] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.824] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0101.824] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0101.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0101.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.825] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d7a [0101.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0101.825] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0101.901] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d7a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3d7a, lpOverlapped=0x0) returned 1 [0101.903] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3d80, lpOverlapped=0x0) returned 1 [0101.904] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.928] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.939] CloseHandle (hObject=0x118) returned 1 [0101.940] CloseHandle (hObject=0x114) returned 1 [0101.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\6d65737361676573.json")) returned 0 [0101.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\6d65737361676573.json")) returned 0x2020 [0101.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0101.942] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.942] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0101.943] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json")) returned 1 [0101.944] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json")) returned 0xffffffff [0101.944] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0101.944] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0101.944] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="es", cAlternateFileName="")) returned 1 [0101.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0101.944] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0101.944] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0101.944] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0101.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0101.945] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0101.945] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0101.945] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0101.945] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0101.945] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0101.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0101.947] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x404b [0101.947] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0101.947] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0102.035] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x404b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x404b, lpOverlapped=0x0) returned 1 [0102.043] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4050, lpOverlapped=0x0) returned 1 [0102.044] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.068] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.079] CloseHandle (hObject=0x114) returned 1 [0102.079] CloseHandle (hObject=0x118) returned 1 [0102.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\6d65737361676573.json")) returned 0 [0102.081] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\6d65737361676573.json")) returned 0x2020 [0102.081] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0102.081] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.081] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0102.082] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json")) returned 1 [0102.083] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json")) returned 0xffffffff [0102.083] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.083] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0102.083] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="et", cAlternateFileName="")) returned 1 [0102.083] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0102.083] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0102.083] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0102.083] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0102.083] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.084] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0102.084] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0102.084] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0102.084] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.084] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0102.084] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0102.084] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0102.085] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.085] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e85 [0102.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0102.085] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0102.176] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e85, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3e85, lpOverlapped=0x0) returned 1 [0102.178] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3e90, lpOverlapped=0x0) returned 1 [0102.179] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.203] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.214] CloseHandle (hObject=0x118) returned 1 [0102.214] CloseHandle (hObject=0x114) returned 1 [0102.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\6d65737361676573.json")) returned 0 [0102.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\6d65737361676573.json")) returned 0x2020 [0102.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0102.216] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.216] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0102.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json")) returned 1 [0102.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json")) returned 0xffffffff [0102.217] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.217] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0102.218] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="fa", cAlternateFileName="")) returned 1 [0102.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0102.218] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0102.218] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0102.218] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0102.218] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.218] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0102.218] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0102.219] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0102.219] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.219] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0102.219] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0102.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.220] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0102.220] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46f5 [0102.220] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0102.221] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0102.309] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x46f5, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x46f5, lpOverlapped=0x0) returned 1 [0102.311] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4700, lpOverlapped=0x0) returned 1 [0102.312] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.335] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.347] CloseHandle (hObject=0x114) returned 1 [0102.347] CloseHandle (hObject=0x118) returned 1 [0102.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\6d65737361676573.json")) returned 0 [0102.349] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\6d65737361676573.json")) returned 0x2020 [0102.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0102.349] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.349] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0102.349] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json")) returned 1 [0102.350] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json")) returned 0xffffffff [0102.350] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.350] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0102.350] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="fi", cAlternateFileName="")) returned 1 [0102.350] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0102.351] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0102.351] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0102.351] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0102.351] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.351] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0102.351] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0102.351] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0102.351] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.352] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0102.352] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0102.352] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0102.352] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.352] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f4c [0102.352] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0102.353] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0102.434] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3f4c, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3f4c, lpOverlapped=0x0) returned 1 [0102.436] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3f50, lpOverlapped=0x0) returned 1 [0102.437] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.460] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.472] CloseHandle (hObject=0x118) returned 1 [0102.472] CloseHandle (hObject=0x114) returned 1 [0102.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\6d65737361676573.json")) returned 0 [0102.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\6d65737361676573.json")) returned 0x2020 [0102.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0102.474] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.474] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0102.474] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json")) returned 1 [0102.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0102.475] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.475] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0102.475] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="fil", cAlternateFileName="")) returned 1 [0102.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0102.476] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0102.476] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0102.476] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0102.476] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.476] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0102.476] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0102.476] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0102.476] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.477] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0102.477] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0102.477] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0102.478] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4082 [0102.478] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0102.478] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0102.567] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4082, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x4082, lpOverlapped=0x0) returned 1 [0102.569] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4090, lpOverlapped=0x0) returned 1 [0102.571] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.593] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.604] CloseHandle (hObject=0x114) returned 1 [0102.605] CloseHandle (hObject=0x118) returned 1 [0102.606] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\6d65737361676573.json")) returned 0 [0102.606] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\6d65737361676573.json")) returned 0x2020 [0102.606] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0102.606] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.606] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0102.607] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json")) returned 1 [0102.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0102.608] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.608] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0102.608] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="fr", cAlternateFileName="")) returned 1 [0102.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0102.608] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0102.608] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0102.608] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0102.609] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.609] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0102.609] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0102.609] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0102.609] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.609] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0102.609] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0102.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0102.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.610] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x419f [0102.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0102.610] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0102.707] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x419f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x419f, lpOverlapped=0x0) returned 1 [0102.714] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x41a0, lpOverlapped=0x0) returned 1 [0102.716] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.738] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.750] CloseHandle (hObject=0x118) returned 1 [0102.750] CloseHandle (hObject=0x114) returned 1 [0102.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\6d65737361676573.json")) returned 0 [0102.752] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\6d65737361676573.json")) returned 0x2020 [0102.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0102.752] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.752] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0102.752] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json")) returned 1 [0102.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0102.753] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.753] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0102.753] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="gu", cAlternateFileName="")) returned 1 [0102.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0102.754] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0102.754] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0102.754] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0102.754] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.754] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0102.754] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0102.754] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0102.754] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.755] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0102.755] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0102.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0102.756] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5079 [0102.756] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0102.756] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0102.830] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5079, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x5079, lpOverlapped=0x0) returned 1 [0102.832] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x5080, lpOverlapped=0x0) returned 1 [0102.833] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.856] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.867] CloseHandle (hObject=0x114) returned 1 [0102.867] CloseHandle (hObject=0x118) returned 1 [0102.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\6d65737361676573.json")) returned 0 [0102.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\6d65737361676573.json")) returned 0x2020 [0102.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0102.869] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.869] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0102.869] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json")) returned 1 [0102.870] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json")) returned 0xffffffff [0102.870] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0102.871] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0102.871] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="hi", cAlternateFileName="")) returned 1 [0102.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0102.871] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0102.871] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0102.871] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0102.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0102.871] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0102.872] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0102.872] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0102.872] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0102.872] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0102.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0102.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.873] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50f7 [0102.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0102.873] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0102.963] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x50f7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x50f7, lpOverlapped=0x0) returned 1 [0102.965] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x5100, lpOverlapped=0x0) returned 1 [0102.966] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.989] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.000] CloseHandle (hObject=0x118) returned 1 [0103.000] CloseHandle (hObject=0x114) returned 1 [0103.001] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\6d65737361676573.json")) returned 0 [0103.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\6d65737361676573.json")) returned 0x2020 [0103.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0103.002] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.002] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0103.002] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json")) returned 1 [0103.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0103.004] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.004] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0103.004] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="hr", cAlternateFileName="")) returned 1 [0103.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0103.004] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0103.004] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0103.004] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0103.004] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.004] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0103.005] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0103.005] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0103.005] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.005] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0103.005] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0103.005] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0103.007] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ff2 [0103.007] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0103.007] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0103.095] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3ff2, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3ff2, lpOverlapped=0x0) returned 1 [0103.097] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4000, lpOverlapped=0x0) returned 1 [0103.098] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.121] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.132] CloseHandle (hObject=0x114) returned 1 [0103.132] CloseHandle (hObject=0x118) returned 1 [0103.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\6d65737361676573.json")) returned 0 [0103.134] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\6d65737361676573.json")) returned 0x2020 [0103.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0103.134] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.134] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0103.135] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json")) returned 1 [0103.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0103.136] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.136] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0103.136] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="hu", cAlternateFileName="")) returned 1 [0103.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0103.136] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0103.136] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0103.136] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0103.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.137] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0103.137] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0103.137] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0103.137] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.137] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0103.137] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0103.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0103.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.138] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40d4 [0103.138] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0103.138] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0103.227] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x40d4, lpOverlapped=0x0) returned 1 [0103.234] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x40e0, lpOverlapped=0x0) returned 1 [0103.236] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.259] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.270] CloseHandle (hObject=0x118) returned 1 [0103.271] CloseHandle (hObject=0x114) returned 1 [0103.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\6d65737361676573.json")) returned 0 [0103.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\6d65737361676573.json")) returned 0x2020 [0103.274] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0103.274] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.274] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0103.274] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json")) returned 1 [0103.275] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0103.275] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.275] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0103.276] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="id", cAlternateFileName="")) returned 1 [0103.276] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0103.276] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0103.276] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0103.277] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0103.277] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.277] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0103.277] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0103.277] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0103.277] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.277] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0103.277] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0103.278] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0103.279] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e5d [0103.279] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0103.280] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0103.352] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e5d, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3e5d, lpOverlapped=0x0) returned 1 [0103.354] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3e60, lpOverlapped=0x0) returned 1 [0103.355] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.403] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.414] CloseHandle (hObject=0x114) returned 1 [0103.414] CloseHandle (hObject=0x118) returned 1 [0103.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\6d65737361676573.json")) returned 0 [0103.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\6d65737361676573.json")) returned 0x2020 [0103.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0103.416] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.416] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0103.417] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json")) returned 1 [0103.418] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json")) returned 0xffffffff [0103.418] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.418] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0103.418] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="it", cAlternateFileName="")) returned 1 [0103.418] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0103.418] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0103.418] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0103.418] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0103.419] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.419] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0103.419] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0103.419] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0103.419] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.419] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0103.419] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0103.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0103.420] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.420] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f0c [0103.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0103.420] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0103.493] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3f0c, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3f0c, lpOverlapped=0x0) returned 1 [0103.495] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f10, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3f10, lpOverlapped=0x0) returned 1 [0103.496] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.520] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.531] CloseHandle (hObject=0x118) returned 1 [0103.532] CloseHandle (hObject=0x114) returned 1 [0103.533] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\6d65737361676573.json")) returned 0 [0103.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\6d65737361676573.json")) returned 0x2020 [0103.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0103.534] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.534] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0103.534] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json")) returned 1 [0103.535] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json")) returned 0xffffffff [0103.535] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.535] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0103.535] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="iw", cAlternateFileName="")) returned 1 [0103.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0103.536] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0103.536] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0103.536] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0103.536] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.536] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0103.536] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0103.537] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0103.537] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.537] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0103.537] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0103.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.538] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0103.539] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5074 [0103.539] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0103.539] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0103.657] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5074, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x5074, lpOverlapped=0x0) returned 1 [0103.659] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x5080, lpOverlapped=0x0) returned 1 [0103.660] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.683] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.694] CloseHandle (hObject=0x114) returned 1 [0103.694] CloseHandle (hObject=0x118) returned 1 [0103.695] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\6d65737361676573.json")) returned 0 [0103.696] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\6d65737361676573.json")) returned 0x2020 [0103.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0103.696] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.696] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0103.696] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json")) returned 1 [0103.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json")) returned 0xffffffff [0103.697] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.697] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0103.698] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ja", cAlternateFileName="")) returned 1 [0103.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0103.698] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0103.698] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0103.698] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0103.698] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.698] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0103.698] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0103.699] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0103.699] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.699] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0103.699] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0103.699] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0103.699] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.700] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x447a [0103.700] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0103.700] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0103.788] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x447a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x447a, lpOverlapped=0x0) returned 1 [0103.790] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4480, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4480, lpOverlapped=0x0) returned 1 [0103.791] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.814] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.825] CloseHandle (hObject=0x118) returned 1 [0103.825] CloseHandle (hObject=0x114) returned 1 [0103.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\6d65737361676573.json")) returned 0 [0103.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\6d65737361676573.json")) returned 0x2020 [0103.827] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0103.827] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.828] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0103.828] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json")) returned 1 [0103.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0103.829] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.829] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0103.829] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="kn", cAlternateFileName="")) returned 1 [0103.829] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0103.829] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0103.829] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0103.830] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0103.830] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.830] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0103.830] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0103.830] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0103.830] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.830] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0103.830] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0103.830] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.831] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0103.832] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55a3 [0103.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0103.832] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0103.905] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x55a3, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x55a3, lpOverlapped=0x0) returned 1 [0103.907] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x55b0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x55b0, lpOverlapped=0x0) returned 1 [0103.909] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.933] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.944] CloseHandle (hObject=0x114) returned 1 [0103.945] CloseHandle (hObject=0x118) returned 1 [0103.946] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\6d65737361676573.json")) returned 0 [0103.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\6d65737361676573.json")) returned 0x2020 [0103.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0103.947] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.947] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0103.947] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json")) returned 1 [0103.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json")) returned 0xffffffff [0103.948] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0103.948] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0103.948] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ko", cAlternateFileName="")) returned 1 [0103.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0103.948] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0103.948] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0103.949] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0103.949] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.949] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0103.949] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0103.949] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0103.949] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0103.949] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0103.949] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0103.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0103.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.950] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x403a [0103.950] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0103.951] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0104.039] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x403a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x403a, lpOverlapped=0x0) returned 1 [0104.041] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4040, lpOverlapped=0x0) returned 1 [0104.042] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.065] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.076] CloseHandle (hObject=0x118) returned 1 [0104.076] CloseHandle (hObject=0x114) returned 1 [0104.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\6d65737361676573.json")) returned 0 [0104.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\6d65737361676573.json")) returned 0x2020 [0104.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0104.078] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.078] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0104.079] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json")) returned 1 [0104.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0104.080] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.080] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0104.080] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="lt", cAlternateFileName="")) returned 1 [0104.080] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0104.080] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0104.080] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0104.080] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0104.080] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.080] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0104.080] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0104.081] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0104.081] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.081] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0104.081] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0104.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0104.082] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0104.082] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x416b [0104.082] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0104.083] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0104.171] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x416b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x416b, lpOverlapped=0x0) returned 1 [0104.173] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4170, lpOverlapped=0x0) returned 1 [0104.174] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.197] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.209] CloseHandle (hObject=0x114) returned 1 [0104.210] CloseHandle (hObject=0x118) returned 1 [0104.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\6d65737361676573.json")) returned 0 [0104.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\6d65737361676573.json")) returned 0x2020 [0104.212] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0104.212] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.212] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0104.212] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json")) returned 1 [0104.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0104.213] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.213] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0104.213] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="lv", cAlternateFileName="")) returned 1 [0104.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0104.214] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0104.214] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0104.214] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0104.214] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.214] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0104.214] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0104.214] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0104.214] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.214] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0104.215] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0104.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0104.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0104.215] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41bf [0104.215] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0104.216] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0104.306] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x41bf, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x41bf, lpOverlapped=0x0) returned 1 [0104.307] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x41c0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x41c0, lpOverlapped=0x0) returned 1 [0104.318] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.341] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.352] CloseHandle (hObject=0x118) returned 1 [0104.353] CloseHandle (hObject=0x114) returned 1 [0104.354] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\6d65737361676573.json")) returned 0 [0104.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\6d65737361676573.json")) returned 0x2020 [0104.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0104.355] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.355] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0104.355] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json")) returned 1 [0104.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0104.356] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.356] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0104.356] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ml", cAlternateFileName="")) returned 1 [0104.356] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0104.356] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0104.357] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0104.357] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0104.357] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.357] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0104.357] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0104.357] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0104.357] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.357] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0104.357] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0104.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0104.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0104.359] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x583f [0104.359] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0104.359] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0104.444] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x583f, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x583f, lpOverlapped=0x0) returned 1 [0104.445] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5840, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x5840, lpOverlapped=0x0) returned 1 [0104.447] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.469] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.480] CloseHandle (hObject=0x114) returned 1 [0104.481] CloseHandle (hObject=0x118) returned 1 [0104.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\6d65737361676573.json")) returned 0 [0104.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\6d65737361676573.json")) returned 0x2020 [0104.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0104.483] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.483] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0104.483] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json")) returned 1 [0104.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json")) returned 0xffffffff [0104.485] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.485] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0104.485] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="mr", cAlternateFileName="")) returned 1 [0104.485] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0104.485] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0104.485] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0104.485] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0104.485] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0104.486] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0104.486] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0104.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0104.486] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0104.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0104.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0104.487] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5224 [0104.487] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0104.487] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0104.586] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5224, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x5224, lpOverlapped=0x0) returned 1 [0104.588] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5230, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x5230, lpOverlapped=0x0) returned 1 [0104.589] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.612] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.623] CloseHandle (hObject=0x118) returned 1 [0104.623] CloseHandle (hObject=0x114) returned 1 [0104.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\6d65737361676573.json")) returned 0 [0104.625] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\6d65737361676573.json")) returned 0x2020 [0104.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0104.625] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.625] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0104.625] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json")) returned 1 [0104.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json")) returned 0xffffffff [0104.626] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.626] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0104.627] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ms", cAlternateFileName="")) returned 1 [0104.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0104.627] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0104.627] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0104.627] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0104.627] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.627] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0104.627] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0104.628] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0104.628] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.628] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0104.628] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0104.628] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0104.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0104.629] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f8b [0104.629] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0104.630] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0104.727] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3f8b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3f8b, lpOverlapped=0x0) returned 1 [0104.729] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3f90, lpOverlapped=0x0) returned 1 [0104.730] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.753] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.764] CloseHandle (hObject=0x114) returned 1 [0104.765] CloseHandle (hObject=0x118) returned 1 [0104.766] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\6d65737361676573.json")) returned 0 [0104.766] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\6d65737361676573.json")) returned 0x2020 [0104.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0104.766] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.766] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0104.767] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json")) returned 1 [0104.768] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0104.768] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.768] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0104.768] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="nb", cAlternateFileName="")) returned 1 [0104.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0104.768] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0104.768] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0104.768] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0104.769] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.769] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0104.769] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0104.769] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0104.769] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.769] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0104.769] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0104.769] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0104.770] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0104.770] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ebc [0104.770] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0104.770] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0104.843] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3ebc, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3ebc, lpOverlapped=0x0) returned 1 [0104.845] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3ec0, lpOverlapped=0x0) returned 1 [0104.846] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.868] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.879] CloseHandle (hObject=0x118) returned 1 [0104.880] CloseHandle (hObject=0x114) returned 1 [0104.881] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\6d65737361676573.json")) returned 0 [0104.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\6d65737361676573.json")) returned 0x2020 [0104.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0104.882] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.882] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0104.882] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json")) returned 1 [0104.883] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json")) returned 0xffffffff [0104.883] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0104.883] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0104.883] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="nl", cAlternateFileName="")) returned 1 [0104.883] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0104.884] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0104.884] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0104.884] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0104.884] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.884] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0104.884] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0104.884] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0104.884] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0104.884] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0104.884] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0104.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0104.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0104.886] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f45 [0104.886] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0104.886] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0104.977] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3f45, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3f45, lpOverlapped=0x0) returned 1 [0104.979] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3f50, lpOverlapped=0x0) returned 1 [0104.980] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.002] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.014] CloseHandle (hObject=0x114) returned 1 [0105.014] CloseHandle (hObject=0x118) returned 1 [0105.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\6d65737361676573.json")) returned 0 [0105.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\6d65737361676573.json")) returned 0x2020 [0105.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0105.016] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.016] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0105.016] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json")) returned 1 [0105.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0105.017] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.017] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0105.018] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="pl", cAlternateFileName="")) returned 1 [0105.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0105.018] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0105.018] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0105.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0105.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0105.018] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0105.019] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0105.019] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.019] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0105.019] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0105.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0105.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.020] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fd7 [0105.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0105.020] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0105.108] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3fd7, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3fd7, lpOverlapped=0x0) returned 1 [0105.110] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3fe0, lpOverlapped=0x0) returned 1 [0105.111] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.133] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.144] CloseHandle (hObject=0x118) returned 1 [0105.145] CloseHandle (hObject=0x114) returned 1 [0105.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\6d65737361676573.json")) returned 0 [0105.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\6d65737361676573.json")) returned 0x2020 [0105.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0105.147] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.147] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0105.147] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json")) returned 1 [0105.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0105.148] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.148] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0105.148] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="pt", cAlternateFileName="")) returned 1 [0105.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0105.149] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0105.149] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0105.149] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0105.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0105.149] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0105.150] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0105.150] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.150] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0105.150] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0105.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0105.151] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0105.151] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0105.151] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0105.240] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3fdc, lpOverlapped=0x0) returned 1 [0105.241] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3fe0, lpOverlapped=0x0) returned 1 [0105.242] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.265] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.276] CloseHandle (hObject=0x114) returned 1 [0105.277] CloseHandle (hObject=0x118) returned 1 [0105.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\6d65737361676573.json")) returned 0 [0105.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\6d65737361676573.json")) returned 0x2020 [0105.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0105.279] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.279] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0105.279] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json")) returned 1 [0105.280] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json")) returned 0xffffffff [0105.280] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.280] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0105.280] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0105.280] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0105.280] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0105.280] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0105.281] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0105.281] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.281] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0105.281] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0105.281] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0105.281] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.281] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0105.281] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0105.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0105.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.282] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0105.282] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0105.282] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0105.360] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3fdc, lpOverlapped=0x0) returned 1 [0105.364] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3fe0, lpOverlapped=0x0) returned 1 [0105.366] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.417] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.428] CloseHandle (hObject=0x118) returned 1 [0105.428] CloseHandle (hObject=0x114) returned 1 [0105.430] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0 [0105.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\6d65737361676573.json")) returned 0x2020 [0105.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0105.431] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.432] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0105.432] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json")) returned 1 [0105.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0105.434] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.434] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0105.434] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0105.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0105.435] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0105.435] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0105.435] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0105.435] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.435] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0105.435] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0105.436] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0105.436] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.436] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0105.436] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0105.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0105.437] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0105.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0105.438] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0105.510] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3fdc, lpOverlapped=0x0) returned 1 [0105.512] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3fe0, lpOverlapped=0x0) returned 1 [0105.514] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.537] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.548] CloseHandle (hObject=0x114) returned 1 [0105.548] CloseHandle (hObject=0x118) returned 1 [0105.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0 [0105.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\6d65737361676573.json")) returned 0x2020 [0105.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0105.550] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.550] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0105.550] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 1 [0105.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0105.551] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.551] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0105.552] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ro", cAlternateFileName="")) returned 1 [0105.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0105.552] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0105.552] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0105.552] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0105.552] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.552] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0105.552] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0105.553] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0105.553] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.553] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0105.553] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0105.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0105.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.554] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40db [0105.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0105.554] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0105.647] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x40db, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x40db, lpOverlapped=0x0) returned 1 [0105.649] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x40e0, lpOverlapped=0x0) returned 1 [0105.650] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.683] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.694] CloseHandle (hObject=0x118) returned 1 [0105.694] CloseHandle (hObject=0x114) returned 1 [0105.696] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\6d65737361676573.json")) returned 0 [0105.696] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\6d65737361676573.json")) returned 0x2020 [0105.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0105.696] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.696] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0105.697] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json")) returned 1 [0105.698] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0105.698] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.698] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0105.698] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ru", cAlternateFileName="")) returned 1 [0105.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0105.698] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0105.698] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0105.699] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0105.699] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.699] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0105.699] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0105.699] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0105.699] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.699] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0105.699] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0105.700] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.700] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0105.701] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x490e [0105.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0105.701] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0105.788] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x490e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x490e, lpOverlapped=0x0) returned 1 [0105.790] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4910, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4910, lpOverlapped=0x0) returned 1 [0105.792] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.814] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.826] CloseHandle (hObject=0x114) returned 1 [0105.826] CloseHandle (hObject=0x118) returned 1 [0105.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\6d65737361676573.json")) returned 0 [0105.828] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\6d65737361676573.json")) returned 0x2020 [0105.828] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0105.828] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.828] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0105.828] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json")) returned 1 [0105.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0105.829] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.829] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0105.831] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="sk", cAlternateFileName="")) returned 1 [0105.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0105.831] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0105.831] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0105.831] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0105.832] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.832] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0105.832] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0105.832] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0105.832] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.832] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0105.832] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0105.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0105.833] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.833] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40fd [0105.833] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0105.833] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0105.905] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x40fd, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x40fd, lpOverlapped=0x0) returned 1 [0105.907] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4100, lpOverlapped=0x0) returned 1 [0105.908] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.932] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.943] CloseHandle (hObject=0x118) returned 1 [0105.943] CloseHandle (hObject=0x114) returned 1 [0105.944] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\6d65737361676573.json")) returned 0 [0105.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\6d65737361676573.json")) returned 0x2020 [0105.945] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0105.945] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.945] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0105.945] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json")) returned 1 [0105.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0105.946] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0105.947] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0105.947] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="sl", cAlternateFileName="")) returned 1 [0105.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0105.947] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0105.947] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0105.948] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0105.948] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.948] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0105.948] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0105.948] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0105.948] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0105.948] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0105.948] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0105.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.949] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0105.950] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x407a [0105.950] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0105.950] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0106.043] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x407a, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x407a, lpOverlapped=0x0) returned 1 [0106.045] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4080, lpOverlapped=0x0) returned 1 [0106.046] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.072] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.085] CloseHandle (hObject=0x114) returned 1 [0106.086] CloseHandle (hObject=0x118) returned 1 [0106.087] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\6d65737361676573.json")) returned 0 [0106.087] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\6d65737361676573.json")) returned 0x2020 [0106.087] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0106.088] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.088] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0106.088] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json")) returned 1 [0106.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0106.089] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.090] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0106.090] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="sr", cAlternateFileName="")) returned 1 [0106.090] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0106.090] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0106.090] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0106.090] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0106.090] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.090] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0106.090] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0106.091] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0106.091] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.091] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0106.091] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0106.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0106.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0106.092] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49c1 [0106.092] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0106.092] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0106.192] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x49c1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x49c1, lpOverlapped=0x0) returned 1 [0106.194] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x49d0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x49d0, lpOverlapped=0x0) returned 1 [0106.195] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.221] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.233] CloseHandle (hObject=0x118) returned 1 [0106.234] CloseHandle (hObject=0x114) returned 1 [0106.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\6d65737361676573.json")) returned 0 [0106.235] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\6d65737361676573.json")) returned 0x2020 [0106.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0106.236] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.236] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0106.236] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json")) returned 1 [0106.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0106.237] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.237] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0106.237] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="sv", cAlternateFileName="")) returned 1 [0106.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0106.238] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0106.238] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0106.238] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0106.238] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.238] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0106.238] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0106.239] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0106.239] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.239] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0106.239] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0106.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0106.240] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0106.240] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e96 [0106.240] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0106.241] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0106.341] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e96, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3e96, lpOverlapped=0x0) returned 1 [0106.343] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3ea0, lpOverlapped=0x0) returned 1 [0106.344] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.379] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.392] CloseHandle (hObject=0x114) returned 1 [0106.392] CloseHandle (hObject=0x118) returned 1 [0106.393] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\6d65737361676573.json")) returned 0 [0106.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\6d65737361676573.json")) returned 0x2020 [0106.394] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0106.394] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.394] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0106.394] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json")) returned 1 [0106.395] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0106.395] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.395] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0106.396] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="sw", cAlternateFileName="")) returned 1 [0106.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0106.396] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0106.396] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0106.396] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0106.396] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.397] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0106.397] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0106.397] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0106.397] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.397] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0106.397] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0106.397] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0106.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0106.398] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e8b [0106.398] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0106.398] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0106.480] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e8b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3e8b, lpOverlapped=0x0) returned 1 [0106.483] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3e90, lpOverlapped=0x0) returned 1 [0106.484] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.510] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.523] CloseHandle (hObject=0x118) returned 1 [0106.523] CloseHandle (hObject=0x114) returned 1 [0106.525] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\6d65737361676573.json")) returned 0 [0106.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\6d65737361676573.json")) returned 0x2020 [0106.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0106.525] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.525] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0106.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json")) returned 1 [0106.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json")) returned 0xffffffff [0106.527] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.527] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0106.527] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="ta", cAlternateFileName="")) returned 1 [0106.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0106.527] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0106.527] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0106.528] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0106.528] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.528] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0106.528] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0106.535] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0106.535] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.535] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0106.535] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0106.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0106.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0106.537] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x563d [0106.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0106.538] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0106.634] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x563d, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x563d, lpOverlapped=0x0) returned 1 [0106.636] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5640, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x5640, lpOverlapped=0x0) returned 1 [0106.638] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.660] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.671] CloseHandle (hObject=0x114) returned 1 [0106.672] CloseHandle (hObject=0x118) returned 1 [0106.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\6d65737361676573.json")) returned 0 [0106.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\6d65737361676573.json")) returned 0x2020 [0106.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0106.674] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.674] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0106.674] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json")) returned 1 [0106.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json")) returned 0xffffffff [0106.675] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.675] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0106.675] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="te", cAlternateFileName="")) returned 1 [0106.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0106.675] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0106.676] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0106.676] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0106.676] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.676] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0106.676] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0106.676] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0106.677] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.677] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0106.677] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0106.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0106.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0106.678] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5593 [0106.678] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0106.678] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0106.777] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5593, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x5593, lpOverlapped=0x0) returned 1 [0106.779] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x55a0, lpOverlapped=0x0) returned 1 [0106.780] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.803] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.814] CloseHandle (hObject=0x118) returned 1 [0106.814] CloseHandle (hObject=0x114) returned 1 [0106.816] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\6d65737361676573.json")) returned 0 [0106.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\6d65737361676573.json")) returned 0x2020 [0106.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0106.817] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.817] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0106.817] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json")) returned 1 [0106.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json")) returned 0xffffffff [0106.818] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.818] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0106.818] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="th", cAlternateFileName="")) returned 1 [0106.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0106.818] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0106.818] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0106.819] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0106.819] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.819] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0106.819] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0106.819] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0106.819] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.819] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0106.819] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0106.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0106.820] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0106.821] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f64 [0106.821] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0106.821] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0106.895] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4f64, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x4f64, lpOverlapped=0x0) returned 1 [0106.897] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4f70, lpOverlapped=0x0) returned 1 [0106.898] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.923] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.934] CloseHandle (hObject=0x114) returned 1 [0106.934] CloseHandle (hObject=0x118) returned 1 [0106.934] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\6d65737361676573.json")) returned 0 [0106.935] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\6d65737361676573.json")) returned 0x2020 [0106.935] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0106.935] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.935] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0106.935] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json")) returned 1 [0106.936] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json")) returned 0xffffffff [0106.936] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0106.936] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0106.936] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="tr", cAlternateFileName="")) returned 1 [0106.936] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0106.937] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0106.937] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0106.937] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0106.937] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.937] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0106.937] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0106.937] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0106.937] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0106.937] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0106.938] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0106.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0106.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0106.938] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x404e [0106.938] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0106.939] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0107.029] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x404e, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x404e, lpOverlapped=0x0) returned 1 [0107.031] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4050, lpOverlapped=0x0) returned 1 [0107.032] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.055] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.066] CloseHandle (hObject=0x118) returned 1 [0107.066] CloseHandle (hObject=0x114) returned 1 [0107.066] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\6d65737361676573.json")) returned 0 [0107.067] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\6d65737361676573.json")) returned 0x2020 [0107.067] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0107.067] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.067] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0107.067] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json")) returned 1 [0107.068] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0107.068] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.068] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0107.068] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="uk", cAlternateFileName="")) returned 1 [0107.068] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0107.069] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0107.069] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0107.069] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0107.069] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.069] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0107.069] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0107.070] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0107.070] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.070] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0107.070] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0107.070] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0107.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0107.072] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48f1 [0107.072] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0107.072] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0107.161] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x48f1, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x48f1, lpOverlapped=0x0) returned 1 [0107.163] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4900, lpOverlapped=0x0) returned 1 [0107.164] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.187] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.199] CloseHandle (hObject=0x114) returned 1 [0107.199] CloseHandle (hObject=0x118) returned 1 [0107.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\6d65737361676573.json")) returned 0 [0107.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\6d65737361676573.json")) returned 0x2020 [0107.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0107.200] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.200] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0107.200] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json")) returned 1 [0107.201] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0107.201] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.201] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0107.201] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="vi", cAlternateFileName="")) returned 1 [0107.201] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0107.201] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0107.201] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0107.202] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0107.202] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.202] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0107.202] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0107.202] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0107.202] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.202] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0107.202] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0107.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0107.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0107.203] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x426b [0107.203] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0107.204] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0107.292] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x426b, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x426b, lpOverlapped=0x0) returned 1 [0107.293] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x4270, lpOverlapped=0x0) returned 1 [0107.295] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.317] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.332] CloseHandle (hObject=0x118) returned 1 [0107.332] CloseHandle (hObject=0x114) returned 1 [0107.332] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\6d65737361676573.json")) returned 0 [0107.333] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\6d65737361676573.json")) returned 0x2020 [0107.333] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0107.333] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.333] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0107.333] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json")) returned 1 [0107.334] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0107.334] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.334] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0107.334] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="zh", cAlternateFileName="")) returned 1 [0107.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0107.335] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0107.335] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0107.335] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0107.335] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.335] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0107.335] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0107.335] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0107.335] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.336] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0107.336] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0107.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0107.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0107.337] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d11 [0107.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0107.337] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0107.424] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d11, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3d11, lpOverlapped=0x0) returned 1 [0107.425] WriteFile (in: hFile=0x118, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3d20, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3d20, lpOverlapped=0x0) returned 1 [0107.426] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.449] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.460] CloseHandle (hObject=0x114) returned 1 [0107.460] CloseHandle (hObject=0x118) returned 1 [0107.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\6d65737361676573.json")) returned 0 [0107.461] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\6d65737361676573.json")) returned 0x2020 [0107.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0107.461] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.461] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0107.462] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json")) returned 1 [0107.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json")) returned 0xffffffff [0107.463] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.463] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0107.463] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0107.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName=".", cAlternateFileName="")) returned 0x325118 [0107.463] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="..", cAlternateFileName="")) returned 1 [0107.463] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0107.463] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0107.463] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.463] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0107.463] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0107.464] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0107.464] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.464] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0107.464] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0107.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0107.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\6d65737361676573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0107.465] GetFileSize (in: hFile=0x118, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d72 [0107.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0107.465] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0107.567] ReadFile (in: hFile=0x118, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d72, lpNumberOfBytesRead=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18dcf8*=0x3d72, lpOverlapped=0x0) returned 1 [0107.569] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x18dcf8, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18dcf8*=0x3d80, lpOverlapped=0x0) returned 1 [0107.571] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.596] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.620] CloseHandle (hObject=0x118) returned 1 [0107.620] CloseHandle (hObject=0x114) returned 1 [0107.620] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0 [0107.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\6D65737361676573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\6d65737361676573.json")) returned 0x2020 [0107.621] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x325158 [0107.621] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dbf4 | out: lpFindFileData=0x18dbf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.621] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0107.621] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json")) returned 1 [0107.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0107.622] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x7735387a, dwReserved1=0x775886cb, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0107.622] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0107.622] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0107.622] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0107.622] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0107.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0107.622] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0107.623] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x1366e6f, dwReserved1=0x31e3e0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0107.623] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0107.623] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.623] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0107.623] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0107.623] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0107.623] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.623] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0107.624] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0107.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0107.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\636f6d70757465645f686173686573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0107.626] GetFileSize (in: hFile=0x11c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7299 [0107.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0107.627] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0107.716] ReadFile (in: hFile=0x11c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7299, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x7299, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x114, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x72a0, lpOverlapped=0x0) returned 1 [0107.735] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.759] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.771] CloseHandle (hObject=0x11c) returned 1 [0107.771] CloseHandle (hObject=0x114) returned 1 [0107.771] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0 [0107.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\636F6D70757465645F686173686573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\636f6d70757465645f686173686573.json")) returned 0x2020 [0107.772] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x325118 [0107.772] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0107.772] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0107.772] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json")) returned 1 [0107.773] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0107.773] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0107.773] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0107.773] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.773] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0107.773] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0107.774] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0107.774] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.774] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0107.774] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0107.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0107.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\76657269666965645f636f6e74656e7473.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0107.775] GetFileSize (in: hFile=0x114, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e39 [0107.775] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0107.775] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0107.849] ReadFile (in: hFile=0x114, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e39, lpNumberOfBytesRead=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18df60*=0x3e39, lpOverlapped=0x0) returned 1 [0107.851] WriteFile (in: hFile=0x11c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x18df60, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18df60*=0x3e40, lpOverlapped=0x0) returned 1 [0107.852] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.877] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.890] CloseHandle (hObject=0x114) returned 1 [0107.890] CloseHandle (hObject=0x11c) returned 1 [0107.890] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0 [0107.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\76657269666965645F636F6E74656E7473.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\76657269666965645f636f6e74656e7473.json")) returned 0x2020 [0107.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x325118 [0107.891] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18de5c | out: lpFindFileData=0x18de5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0107.891] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0107.891] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json")) returned 1 [0107.892] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0107.892] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x7735387a, dwReserved1=0x775884a3, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0107.892] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0107.892] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ba1b, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0107.892] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0107.892] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 0 [0107.892] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0107.893] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0107.893] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0107.893] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Favicons", cAlternateFileName="")) returned 1 [0107.893] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0107.893] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.893] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0107.893] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0107.894] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0107.894] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0107.894] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0107.894] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0107.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0107.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\46617669636F6E73" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\46617669636f6e73"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0107.895] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5000 [0107.895] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0107.895] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0107.996] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x5000, lpOverlapped=0x0) returned 1 [0107.998] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x5010, lpOverlapped=0x0) returned 1 [0107.999] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.024] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.035] CloseHandle (hObject=0x100) returned 1 [0108.035] CloseHandle (hObject=0x10c) returned 1 [0108.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\46617669636F6E73" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\46617669636f6e73")) returned 0 [0108.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\46617669636F6E73" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\46617669636f6e73")) returned 0x2020 [0108.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Favicons", cAlternateFileName="")) returned 0x325018 [0108.036] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Favicons", cAlternateFileName="")) returned 0 [0108.036] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0108.036] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons")) returned 1 [0108.037] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons")) returned 0xffffffff [0108.037] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1 [0108.037] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0108.037] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.038] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0108.038] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0108.038] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0108.038] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.038] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0108.038] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0108.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0108.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\46617669636F6E732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\46617669636f6e732d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.039] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0108.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0108.039] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0108.167] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\46617669636F6E732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\46617669636f6e732d6a6f75726e616c")) returned 0 [0108.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\46617669636F6E732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\46617669636f6e732d6a6f75726e616c")) returned 0x2020 [0108.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 0x325018 [0108.168] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 0 [0108.168] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0108.168] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal")) returned 1 [0108.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal")) returned 0xffffffff [0108.168] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0108.168] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0108.168] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.169] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0108.169] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0108.169] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0108.169] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.169] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0108.169] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0108.169] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.170] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\476F6F676C652050726F66696C65.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\476f6f676c652050726f66696c65.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0108.170] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b2e9 [0108.170] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0108.170] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0108.243] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b2e9, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x2b2e9, lpOverlapped=0x0) returned 1 [0108.248] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b2f0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x2b2f0, lpOverlapped=0x0) returned 1 [0108.268] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.291] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.302] CloseHandle (hObject=0x100) returned 1 [0108.302] CloseHandle (hObject=0x10c) returned 1 [0108.302] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\476F6F676C652050726F66696C65.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\476f6f676c652050726f66696c65.ico")) returned 0 [0108.302] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\476F6F676C652050726F66696C65.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\476f6f676c652050726f66696c65.ico")) returned 0x2020 [0108.303] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 0x325018 [0108.303] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 0 [0108.303] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0108.303] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 1 [0108.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 0xffffffff [0108.305] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="History", cAlternateFileName="")) returned 1 [0108.305] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0108.305] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.305] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0108.305] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0108.306] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0108.306] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.306] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0108.306] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0108.306] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0108.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F7279" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f7279"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.308] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19000 [0108.308] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0108.308] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0108.390] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x19000, lpOverlapped=0x0) returned 1 [0108.398] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x19010, lpOverlapped=0x0) returned 1 [0108.400] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.423] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.434] CloseHandle (hObject=0x10c) returned 1 [0108.434] CloseHandle (hObject=0x100) returned 1 [0108.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F7279" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f7279")) returned 0 [0108.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F7279" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f7279")) returned 0x2020 [0108.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="History", cAlternateFileName="")) returned 0x325018 [0108.435] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="History", cAlternateFileName="")) returned 0 [0108.435] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0108.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history")) returned 1 [0108.437] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history")) returned 0xffffffff [0108.437] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x0, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1 [0108.437] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0108.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0108.437] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0108.437] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0108.438] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.438] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0108.438] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0108.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F72792050726F7669646572204361636865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f72792050726f7669646572204361636865"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0108.439] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142f [0108.439] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0108.439] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0108.533] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x142f, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x142f, lpOverlapped=0x0) returned 1 [0108.535] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1430, lpOverlapped=0x0) returned 1 [0108.536] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.561] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.575] CloseHandle (hObject=0x100) returned 1 [0108.575] CloseHandle (hObject=0x10c) returned 1 [0108.575] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F72792050726F7669646572204361636865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f72792050726f7669646572204361636865")) returned 0 [0108.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F72792050726F7669646572204361636865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f72792050726f7669646572204361636865")) returned 0x2020 [0108.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 0x325018 [0108.576] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 0 [0108.576] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0108.576] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache")) returned 1 [0108.577] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache")) returned 0xffffffff [0108.577] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1 [0108.577] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0108.577] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.577] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0108.577] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0108.578] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0108.578] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.578] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0108.578] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0108.578] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0108.578] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F72792D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f72792d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.579] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0108.579] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0108.579] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0108.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F72792D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f72792d6a6f75726e616c")) returned 0 [0108.727] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\486973746F72792D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\486973746f72792d6a6f75726e616c")) returned 0x2020 [0108.728] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 0x325018 [0108.728] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 0 [0108.728] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0108.728] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal")) returned 1 [0108.728] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal")) returned 0xffffffff [0108.728] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIcons", cAlternateFileName="JUMPLI~2")) returned 1 [0108.728] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x325018 [0108.728] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0108.728] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x329f28, cFileName="A058.tmp", cAlternateFileName="")) returned 1 [0108.729] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0108.729] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.729] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0108.729] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0108.729] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0108.729] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.729] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0108.729] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0108.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0108.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\41303538.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\41303538.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0108.730] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0108.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0108.731] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0108.855] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\41303538.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\41303538.tmp")) returned 0 [0108.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\41303538.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\41303538.tmp")) returned 0x2020 [0108.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="A058.tmp", cAlternateFileName="")) returned 0x325058 [0108.856] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="A058.tmp", cAlternateFileName="")) returned 0 [0108.856] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0108.856] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp")) returned 1 [0108.856] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp")) returned 0xffffffff [0108.856] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="A059.tmp", cAlternateFileName="")) returned 1 [0108.856] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0108.856] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.856] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0108.856] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0108.857] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0108.857] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.857] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0108.857] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0108.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0108.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\41303539.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\41303539.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0108.858] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0108.858] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0108.858] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0108.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\41303539.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\41303539.tmp")) returned 0 [0108.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\41303539.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\41303539.tmp")) returned 0x2020 [0108.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="A059.tmp", cAlternateFileName="")) returned 0x325058 [0108.986] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="A059.tmp", cAlternateFileName="")) returned 0 [0108.986] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0108.986] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp")) returned 1 [0108.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp")) returned 0xffffffff [0108.986] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="A059.tmp", cAlternateFileName="")) returned 0 [0108.987] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0108.987] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIconsOld", cAlternateFileName="JUMPLI~1")) returned 1 [0108.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0108.987] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0108.987] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="2B03.tmp", cAlternateFileName="")) returned 1 [0108.987] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0108.987] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.987] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0108.987] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0108.988] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0108.988] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0108.988] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0108.988] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0108.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0108.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\32423033.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\32423033.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0108.989] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0108.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0108.990] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0109.100] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\32423033.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\32423033.tmp")) returned 0 [0109.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\32423033.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\32423033.tmp")) returned 0x2020 [0109.100] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2B03.tmp", cAlternateFileName="")) returned 0x325058 [0109.100] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2B03.tmp", cAlternateFileName="")) returned 0 [0109.100] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0109.100] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp")) returned 1 [0109.101] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp")) returned 0xffffffff [0109.101] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="2B04.tmp", cAlternateFileName="")) returned 1 [0109.101] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.101] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.101] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.101] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.101] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.101] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.101] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.102] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0109.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\32423034.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\32423034.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0109.102] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0109.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0109.103] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0109.241] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\32423034.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\32423034.tmp")) returned 0 [0109.242] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\32423034.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\32423034.tmp")) returned 0x2020 [0109.242] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2B04.tmp", cAlternateFileName="")) returned 0x325058 [0109.242] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2B04.tmp", cAlternateFileName="")) returned 0 [0109.242] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0109.242] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp")) returned 1 [0109.242] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp")) returned 0xffffffff [0109.242] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="2B04.tmp", cAlternateFileName="")) returned 0 [0109.242] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0109.242] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1 [0109.242] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0109.243] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0109.243] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0109.243] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc00ca, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0109.245] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc00ca, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0109.245] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc00ca, dwReserved1=0x31e3e0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0109.247] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.247] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.250] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.250] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.250] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.250] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.250] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.251] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0109.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\303030303033.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0109.252] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0109.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0109.252] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0109.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\303030303033.log")) returned 0 [0109.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\303030303033.log")) returned 0x2020 [0109.386] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="000003.log", cAlternateFileName="")) returned 0x325098 [0109.386] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="000003.log", cAlternateFileName="")) returned 0 [0109.386] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0109.386] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log")) returned 1 [0109.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log")) returned 0xffffffff [0109.387] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0109.387] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.387] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.387] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.387] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.387] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.387] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.387] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.388] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0109.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\43555252454e54"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0109.388] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0109.388] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0109.389] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0109.468] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x10, lpOverlapped=0x0) returned 1 [0109.469] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x20, lpOverlapped=0x0) returned 1 [0109.470] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.493] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.505] CloseHandle (hObject=0x110) returned 1 [0109.505] CloseHandle (hObject=0x108) returned 1 [0109.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\43555252454e54")) returned 0 [0109.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\43555252454e54")) returned 0x2020 [0109.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CURRENT", cAlternateFileName="")) returned 0x325098 [0109.505] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CURRENT", cAlternateFileName="")) returned 0 [0109.506] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0109.506] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current")) returned 1 [0109.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current")) returned 0xffffffff [0109.507] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="LOCK", cAlternateFileName="")) returned 1 [0109.507] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.507] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.507] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.507] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.507] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.507] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.507] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.507] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0109.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4c4f434b"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0109.508] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0109.508] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0109.509] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0109.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4c4f434b")) returned 0 [0109.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4c4f434b")) returned 0x2020 [0109.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="LOCK", cAlternateFileName="")) returned 0x325098 [0109.658] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="LOCK", cAlternateFileName="")) returned 0 [0109.658] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0109.658] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock")) returned 1 [0109.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock")) returned 0xffffffff [0109.658] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97256fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="LOG", cAlternateFileName="")) returned 1 [0109.658] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.658] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.658] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.659] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.659] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.659] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.659] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.659] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.659] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0109.660] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4c4f47"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0109.661] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0109.661] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0109.662] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0109.754] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xc4, lpOverlapped=0x0) returned 1 [0109.755] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xd0, lpOverlapped=0x0) returned 1 [0109.756] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.779] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.790] CloseHandle (hObject=0x110) returned 1 [0109.790] CloseHandle (hObject=0x108) returned 1 [0109.791] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4c4f47")) returned 0 [0109.791] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4c4f47")) returned 0x2020 [0109.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97256fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="LOG", cAlternateFileName="")) returned 0x325098 [0109.791] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97256fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="LOG", cAlternateFileName="")) returned 0 [0109.791] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0109.791] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log")) returned 1 [0109.792] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log")) returned 0xffffffff [0109.792] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0109.792] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.793] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.793] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.793] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.793] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.793] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.793] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.793] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.793] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0109.794] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4d414e49464553542d303030303031"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0109.794] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29 [0109.794] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0109.794] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0109.883] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x29, lpOverlapped=0x0) returned 1 [0109.884] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x30, lpOverlapped=0x0) returned 1 [0109.885] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.907] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.920] CloseHandle (hObject=0x108) returned 1 [0109.920] CloseHandle (hObject=0x110) returned 1 [0109.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4d414e49464553542d303030303031")) returned 0 [0109.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\4d414e49464553542d303030303031")) returned 0x2020 [0109.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0x325098 [0109.921] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0109.921] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0109.921] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001")) returned 1 [0109.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001")) returned 0xffffffff [0109.922] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0109.922] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0109.922] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 0 [0109.922] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0109.922] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656f6d70, dwReserved1=0x6e6e6e63, cFileName="Local Storage", cAlternateFileName="LOCALS~1")) returned 1 [0109.922] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0109.923] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0109.923] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9048b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x31303030, dwReserved1=0x7758bd6b, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cAlternateFileName="CHROME~1.LOC")) returned 1 [0109.924] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.924] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.924] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.924] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.924] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.924] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.924] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.924] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.924] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 1 [0109.925] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.925] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.925] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.925] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.925] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.925] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.925] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.925] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.925] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 0 [0109.925] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0109.926] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0109.926] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0109.926] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.926] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0109.926] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0109.927] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0109.927] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0109.927] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0109.927] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0109.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0109.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4C6F67696E2044617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4c6f67696e2044617461"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0109.928] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4800 [0109.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0109.929] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0110.017] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x4800, lpOverlapped=0x0) returned 1 [0110.019] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4810, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x4810, lpOverlapped=0x0) returned 1 [0110.020] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.043] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.054] CloseHandle (hObject=0x100) returned 1 [0110.054] CloseHandle (hObject=0x10c) returned 1 [0110.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4C6F67696E2044617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4c6f67696e2044617461")) returned 0 [0110.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4C6F67696E2044617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4c6f67696e2044617461")) returned 0x2020 [0110.055] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 0x325018 [0110.055] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 0 [0110.055] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0110.055] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 1 [0110.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 0xffffffff [0110.056] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 1 [0110.057] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0110.057] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.057] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0110.057] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0110.057] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0110.057] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.057] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0110.057] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0110.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0110.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4C6F67696E20446174612D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4c6f67696e20446174612d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0110.058] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0110.058] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0110.058] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0110.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4C6F67696E20446174612D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4c6f67696e20446174612d6a6f75726e616c")) returned 0 [0110.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4C6F67696E20446174612D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4c6f67696e20446174612d6a6f75726e616c")) returned 0x2020 [0110.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 0x325018 [0110.184] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 0 [0110.184] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0110.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal")) returned 1 [0110.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal")) returned 0xffffffff [0110.185] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 1 [0110.185] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0110.185] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.185] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0110.185] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0110.185] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0110.186] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.186] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0110.186] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0110.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0110.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B20416374696F6E20507265646963746F72" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b20416374696f6e20507265646963746f72"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0110.187] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c00 [0110.187] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0110.188] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0110.261] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x3c00, lpOverlapped=0x0) returned 1 [0110.262] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3c10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x3c10, lpOverlapped=0x0) returned 1 [0110.264] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.286] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.297] CloseHandle (hObject=0x100) returned 1 [0110.297] CloseHandle (hObject=0x10c) returned 1 [0110.297] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B20416374696F6E20507265646963746F72" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b20416374696f6e20507265646963746f72")) returned 0 [0110.298] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B20416374696F6E20507265646963746F72" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b20416374696f6e20507265646963746f72")) returned 0x2020 [0110.298] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 0x325018 [0110.298] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 0 [0110.298] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0110.298] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor")) returned 1 [0110.299] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor")) returned 0xffffffff [0110.299] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 1 [0110.299] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0110.299] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.300] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0110.300] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0110.300] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0110.300] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.300] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0110.300] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0110.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0110.301] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B20416374696F6E20507265646963746F722D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b20416374696f6e20507265646963746f722d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0110.301] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0110.301] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0110.301] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0110.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B20416374696F6E20507265646963746F722D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b20416374696f6e20507265646963746f722d6a6f75726e616c")) returned 0 [0110.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B20416374696F6E20507265646963746F722D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b20416374696f6e20507265646963746f722d6a6f75726e616c")) returned 0x2020 [0110.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 0x325018 [0110.459] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 0 [0110.459] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0110.459] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal")) returned 1 [0110.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal")) returned 0xffffffff [0110.459] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 1 [0110.459] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0110.459] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.459] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0110.460] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0110.460] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0110.460] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.460] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0110.460] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0110.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0110.461] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B2050657273697374656E74205374617465" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b2050657273697374656e74205374617465"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0110.461] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28 [0110.461] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0110.461] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0110.553] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x28, lpOverlapped=0x0) returned 1 [0110.554] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x30, lpOverlapped=0x0) returned 1 [0110.555] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.578] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.589] CloseHandle (hObject=0x100) returned 1 [0110.589] CloseHandle (hObject=0x10c) returned 1 [0110.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B2050657273697374656E74205374617465" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b2050657273697374656e74205374617465")) returned 0 [0110.590] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4E6574776F726B2050657273697374656E74205374617465" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4e6574776f726b2050657273697374656e74205374617465")) returned 0x2020 [0110.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 0x325018 [0110.590] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 0 [0110.590] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0110.590] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state")) returned 1 [0110.591] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state")) returned 0xffffffff [0110.591] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 1 [0110.591] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0110.591] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.591] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0110.592] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0110.592] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0110.592] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.592] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0110.592] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0110.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0110.593] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4F726967696E20426F756E64204365727473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4f726967696e20426f756e64204365727473"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0110.593] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1400 [0110.593] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0110.593] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0110.667] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1400, lpOverlapped=0x0) returned 1 [0110.669] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1410, lpOverlapped=0x0) returned 1 [0110.670] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.692] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.703] CloseHandle (hObject=0x10c) returned 1 [0110.703] CloseHandle (hObject=0x100) returned 1 [0110.703] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4F726967696E20426F756E64204365727473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4f726967696e20426f756e64204365727473")) returned 0 [0110.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4F726967696E20426F756E64204365727473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4f726967696e20426f756e64204365727473")) returned 0x2020 [0110.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 0x325018 [0110.704] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 0 [0110.704] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0110.704] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs")) returned 1 [0110.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs")) returned 0xffffffff [0110.705] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 1 [0110.706] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0110.706] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.706] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0110.706] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0110.706] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0110.706] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.706] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0110.706] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0110.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0110.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4F726967696E20426F756E642043657274732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4f726967696e20426f756e642043657274732d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0110.707] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0110.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0110.707] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0110.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4F726967696E20426F756E642043657274732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4f726967696e20426f756e642043657274732d6a6f75726e616c")) returned 0 [0110.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\4F726967696E20426F756E642043657274732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\4f726967696e20426f756e642043657274732d6a6f75726e616c")) returned 0x2020 [0110.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 0x325018 [0110.841] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 0 [0110.841] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0110.841] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal")) returned 1 [0110.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal")) returned 0xffffffff [0110.841] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 1 [0110.842] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0110.842] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.842] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0110.842] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0110.842] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0110.842] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.842] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0110.842] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0110.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0110.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\507265666572656E636573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\507265666572656e636573"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0110.843] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a9d [0110.843] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0110.843] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0110.932] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a9d, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1a9d, lpOverlapped=0x0) returned 1 [0110.934] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1aa0, lpOverlapped=0x0) returned 1 [0110.935] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.958] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.970] CloseHandle (hObject=0x10c) returned 1 [0110.970] CloseHandle (hObject=0x100) returned 1 [0110.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\507265666572656E636573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\507265666572656e636573")) returned 0 [0110.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\507265666572656E636573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\507265666572656e636573")) returned 0x2020 [0110.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 0x325018 [0110.971] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 0 [0110.971] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0110.971] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences")) returned 1 [0110.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences")) returned 0xffffffff [0110.972] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 1 [0110.972] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0110.972] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.972] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0110.972] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0110.973] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0110.973] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0110.973] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0110.973] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0110.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0110.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\70726576696577735F6F70745F6F7574.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\70726576696577735f6f70745f6f7574.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0110.974] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0110.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0110.974] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0111.065] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x4000, lpOverlapped=0x0) returned 1 [0111.067] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x4010, lpOverlapped=0x0) returned 1 [0111.068] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.091] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.102] CloseHandle (hObject=0x100) returned 1 [0111.102] CloseHandle (hObject=0x10c) returned 1 [0111.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\70726576696577735F6F70745F6F7574.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\70726576696577735f6f70745f6f7574.db")) returned 0 [0111.103] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\70726576696577735F6F70745F6F7574.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\70726576696577735f6f70745f6f7574.db")) returned 0x2020 [0111.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 0x325018 [0111.103] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 0 [0111.103] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0111.103] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 1 [0111.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 0xffffffff [0111.104] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 1 [0111.105] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0111.105] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.105] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0111.105] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0111.105] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0111.105] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.105] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0111.105] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0111.105] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 1 [0111.106] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0111.106] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.106] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0111.106] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0111.106] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0111.106] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.106] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0111.106] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0111.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0111.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\51756F74614D616E61676572" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\51756f74614d616e61676572"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0111.107] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c00 [0111.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0111.107] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0111.180] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x3c00, lpOverlapped=0x0) returned 1 [0111.182] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3c10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x3c10, lpOverlapped=0x0) returned 1 [0111.183] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.206] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.217] CloseHandle (hObject=0x10c) returned 1 [0111.217] CloseHandle (hObject=0x100) returned 1 [0111.217] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\51756F74614D616E61676572" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\51756f74614d616e61676572")) returned 0 [0111.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\51756F74614D616E61676572" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\51756f74614d616e61676572")) returned 0x2020 [0111.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 0x325018 [0111.218] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 0 [0111.218] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0111.218] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager")) returned 1 [0111.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager")) returned 0xffffffff [0111.219] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 1 [0111.220] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0111.220] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.220] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0111.220] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0111.221] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0111.221] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.221] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0111.221] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0111.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0111.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\51756F74614D616E616765722D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\51756f74614d616e616765722d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0111.224] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0111.224] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0111.224] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0111.347] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\51756F74614D616E616765722D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\51756f74614d616e616765722d6a6f75726e616c")) returned 0 [0111.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\51756F74614D616E616765722D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\51756f74614d616e616765722d6a6f75726e616c")) returned 0x2020 [0111.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 0x325018 [0111.348] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 0 [0111.348] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0111.348] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal")) returned 1 [0111.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal")) returned 0xffffffff [0111.348] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f846500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f846500, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="README", cAlternateFileName="")) returned 1 [0111.348] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0111.348] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.348] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0111.349] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0111.349] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0111.349] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.349] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0111.349] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0111.349] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0111.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\524541444D45" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\524541444d45"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0111.350] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4 [0111.350] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0111.350] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0111.438] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xb4, lpOverlapped=0x0) returned 1 [0111.439] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xc0, lpOverlapped=0x0) returned 1 [0111.440] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.462] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.473] CloseHandle (hObject=0x10c) returned 1 [0111.473] CloseHandle (hObject=0x100) returned 1 [0111.474] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\524541444D45" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\524541444d45")) returned 0 [0111.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\524541444D45" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\524541444d45")) returned 0x2020 [0111.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f846500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f846500, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="README", cAlternateFileName="")) returned 0x325018 [0111.474] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f846500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f846500, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="README", cAlternateFileName="")) returned 0 [0111.474] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0111.474] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme")) returned 1 [0111.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme")) returned 0xffffffff [0111.475] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3f38f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c404a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 1 [0111.476] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0111.476] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.476] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0111.476] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0111.476] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0111.476] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.476] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0111.476] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0111.476] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0111.477] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53656375726520507265666572656E636573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53656375726520507265666572656e636573"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0111.477] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b43 [0111.477] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0111.477] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0111.592] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8b43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x8b43, lpOverlapped=0x0) returned 1 [0111.594] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8b50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x8b50, lpOverlapped=0x0) returned 1 [0111.596] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.618] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.630] CloseHandle (hObject=0x100) returned 1 [0111.630] CloseHandle (hObject=0x10c) returned 1 [0111.630] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53656375726520507265666572656E636573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53656375726520507265666572656e636573")) returned 0 [0111.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53656375726520507265666572656E636573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53656375726520507265666572656e636573")) returned 0x2020 [0111.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3f38f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c404a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8b43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 0x325018 [0111.631] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3f38f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c404a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8b43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 0 [0111.631] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0111.631] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences")) returned 1 [0111.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences")) returned 0xffffffff [0111.632] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82271b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 1 [0111.632] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0111.632] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.632] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0111.632] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0111.633] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0111.633] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.633] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0111.633] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0111.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0111.634] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53686F727463757473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53686f727463757473"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0111.634] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0111.634] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0111.635] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0111.723] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x3000, lpOverlapped=0x0) returned 1 [0111.725] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x3010, lpOverlapped=0x0) returned 1 [0111.726] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.748] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.759] CloseHandle (hObject=0x10c) returned 1 [0111.760] CloseHandle (hObject=0x100) returned 1 [0111.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53686F727463757473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53686f727463757473")) returned 0 [0111.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53686F727463757473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53686f727463757473")) returned 0x2020 [0111.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82271b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 0x325018 [0111.760] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82271b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 0 [0111.760] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0111.760] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts")) returned 1 [0111.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts")) returned 0xffffffff [0111.761] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x822e3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 1 [0111.762] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0111.762] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.762] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0111.762] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0111.762] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0111.762] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.762] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0111.762] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0111.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0111.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53686F7274637574732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53686f7274637574732d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0111.763] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0111.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0111.764] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0111.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53686F7274637574732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53686f7274637574732d6a6f75726e616c")) returned 0 [0111.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\53686F7274637574732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\53686f7274637574732d6a6f75726e616c")) returned 0x2020 [0111.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x822e3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 0x325018 [0111.884] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x822e3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 0 [0111.884] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0111.884] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal")) returned 1 [0111.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal")) returned 0xffffffff [0111.885] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Sync Extension Settings", cAlternateFileName="SYNCEX~1")) returned 1 [0111.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0111.885] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0111.885] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31e3e0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0111.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325058 [0111.889] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0111.889] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="000003.log", cAlternateFileName="")) returned 1 [0111.890] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0111.890] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.890] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0111.890] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0111.890] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0111.890] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0111.890] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0111.890] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0111.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0111.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\303030303033.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0111.893] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0111.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0111.893] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0112.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\303030303033.log")) returned 0 [0112.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\303030303033.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\303030303033.log")) returned 0x2020 [0112.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="000003.log", cAlternateFileName="")) returned 0x325098 [0112.019] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="000003.log", cAlternateFileName="")) returned 0 [0112.019] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0112.019] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log")) returned 1 [0112.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log")) returned 0xffffffff [0112.019] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0112.019] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0112.019] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.020] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0112.020] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0112.020] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0112.020] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.020] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0112.020] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0112.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0112.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\43555252454e54"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0112.021] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0112.021] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0112.021] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0112.111] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x10, lpOverlapped=0x0) returned 1 [0112.111] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x20, lpOverlapped=0x0) returned 1 [0112.112] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.137] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.148] CloseHandle (hObject=0x108) returned 1 [0112.148] CloseHandle (hObject=0x110) returned 1 [0112.148] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\43555252454e54")) returned 0 [0112.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\43555252454E54" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\43555252454e54")) returned 0x2020 [0112.149] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CURRENT", cAlternateFileName="")) returned 0x325098 [0112.149] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CURRENT", cAlternateFileName="")) returned 0 [0112.149] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0112.149] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current")) returned 1 [0112.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current")) returned 0xffffffff [0112.150] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="LOCK", cAlternateFileName="")) returned 1 [0112.150] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0112.150] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0112.151] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0112.151] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0112.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0112.151] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0112.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0112.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4c4f434b"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0112.152] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0112.152] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0112.152] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0112.287] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4c4f434b")) returned 0 [0112.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4C4F434B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4c4f434b")) returned 0x2020 [0112.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="LOCK", cAlternateFileName="")) returned 0x325098 [0112.287] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="LOCK", cAlternateFileName="")) returned 0 [0112.287] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0112.288] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock")) returned 1 [0112.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock")) returned 0xffffffff [0112.288] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x93935fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="LOG", cAlternateFileName="")) returned 1 [0112.288] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0112.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0112.288] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0112.289] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0112.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0112.289] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0112.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0112.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4c4f47"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0112.290] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc3 [0112.290] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0112.290] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0112.409] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xc3, lpOverlapped=0x0) returned 1 [0112.410] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xd0, lpOverlapped=0x0) returned 1 [0112.411] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.437] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.449] CloseHandle (hObject=0x108) returned 1 [0112.449] CloseHandle (hObject=0x110) returned 1 [0112.449] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4c4f47")) returned 0 [0112.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4C4F47" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4c4f47")) returned 0x2020 [0112.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x93935fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="LOG", cAlternateFileName="")) returned 0x325098 [0112.450] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x93935fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="LOG", cAlternateFileName="")) returned 0 [0112.450] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0112.450] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log")) returned 1 [0112.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log")) returned 0xffffffff [0112.451] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0112.451] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0112.451] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.452] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0112.452] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0112.452] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0112.452] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.452] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0112.452] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0112.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0112.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4d414e49464553542d303030303031"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0112.453] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29 [0112.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0112.454] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0112.534] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x29, lpOverlapped=0x0) returned 1 [0112.535] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x30, lpOverlapped=0x0) returned 1 [0112.536] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.561] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.574] CloseHandle (hObject=0x110) returned 1 [0112.574] CloseHandle (hObject=0x108) returned 1 [0112.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4d414e49464553542d303030303031")) returned 0 [0112.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4D414E49464553542D303030303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\4d414e49464553542d303030303031")) returned 0x2020 [0112.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0x325098 [0112.575] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0112.575] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0112.575] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001")) returned 1 [0112.576] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001")) returned 0xffffffff [0112.576] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0112.576] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0112.577] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31e3e0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0112.577] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0112.577] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 1 [0112.577] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0112.577] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.577] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0112.577] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0112.578] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0112.578] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.578] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0112.578] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0112.578] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0112.581] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\546F70205369746573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\546f70205369746573"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0112.582] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5000 [0112.582] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0112.582] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0112.671] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x5000, lpOverlapped=0x0) returned 1 [0112.673] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x5010, lpOverlapped=0x0) returned 1 [0112.674] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.697] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.708] CloseHandle (hObject=0x10c) returned 1 [0112.708] CloseHandle (hObject=0x100) returned 1 [0112.708] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\546F70205369746573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\546f70205369746573")) returned 0 [0112.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\546F70205369746573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\546f70205369746573")) returned 0x2020 [0112.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 0x325018 [0112.709] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 0 [0112.709] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0112.709] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites")) returned 1 [0112.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites")) returned 0xffffffff [0112.710] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d8c9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81984910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 1 [0112.711] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0112.711] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.711] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0112.711] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0112.711] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0112.711] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.711] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0112.711] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0112.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0112.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\546F702053697465732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\546f702053697465732d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0112.712] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0112.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0112.712] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0112.855] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\546F702053697465732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\546f702053697465732d6a6f75726e616c")) returned 0 [0112.856] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\546F702053697465732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\546f702053697465732d6a6f75726e616c")) returned 0x2020 [0112.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d8c9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81984910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 0x325018 [0112.856] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d8c9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81984910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 0 [0112.856] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0112.856] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal")) returned 1 [0112.856] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal")) returned 0xffffffff [0112.856] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c2e920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x88c2e920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x88c2e920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 1 [0112.857] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0112.857] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.857] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0112.857] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0112.857] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0112.857] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.857] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0112.857] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0112.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0112.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\5472616E73706F72745365637572697479" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\5472616e73706f72745365637572697479"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0112.858] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x278 [0112.858] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0112.858] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0112.953] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x278, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x278, lpOverlapped=0x0) returned 1 [0112.954] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x280, lpOverlapped=0x0) returned 1 [0112.955] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.978] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.989] CloseHandle (hObject=0x10c) returned 1 [0112.989] CloseHandle (hObject=0x100) returned 1 [0112.989] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\5472616E73706F72745365637572697479" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\5472616e73706f72745365637572697479")) returned 0 [0112.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\5472616E73706F72745365637572697479" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\5472616e73706f72745365637572697479")) returned 0x2020 [0112.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c2e920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x88c2e920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x88c2e920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 0x325018 [0112.990] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c2e920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x88c2e920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x88c2e920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 0 [0112.990] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0112.990] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity")) returned 1 [0112.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity")) returned 0xffffffff [0112.992] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ee3600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80ee3600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6cde50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 1 [0112.992] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0112.992] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.992] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0112.992] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0112.992] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0112.992] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0112.992] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0112.992] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0112.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0112.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\56697369746564204C696E6B73" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\56697369746564204c696e6b73"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0112.995] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20000 [0112.995] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0112.995] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0113.068] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x20000, lpOverlapped=0x0) returned 1 [0113.072] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x20010, lpOverlapped=0x0) returned 1 [0113.075] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.098] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.109] CloseHandle (hObject=0x100) returned 1 [0113.109] CloseHandle (hObject=0x10c) returned 1 [0113.110] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\56697369746564204C696E6B73" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\56697369746564204c696e6b73")) returned 0 [0113.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\56697369746564204C696E6B73" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\56697369746564204c696e6b73")) returned 0x2020 [0113.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ee3600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80ee3600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6cde50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 0x325018 [0113.110] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ee3600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80ee3600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6cde50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 0 [0113.110] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0113.110] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links")) returned 1 [0113.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links")) returned 0xffffffff [0113.112] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Applications", cAlternateFileName="WEBAPP~1")) returned 1 [0113.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x325018 [0113.112] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0113.112] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x329f28, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 1 [0113.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325058 [0113.113] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0113.113] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0113.113] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0113.113] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.113] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0113.113] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0113.114] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0113.114] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.114] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0113.114] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0113.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0113.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\476F6F676C6520446F6373.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\476f6f676c6520446f6373.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0113.116] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28df6 [0113.117] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0113.117] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0113.206] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x28df6, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x28df6, lpOverlapped=0x0) returned 1 [0113.212] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x28e00, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x28e00, lpOverlapped=0x0) returned 1 [0113.215] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.238] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.249] CloseHandle (hObject=0x108) returned 1 [0113.249] CloseHandle (hObject=0x110) returned 1 [0113.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\476F6F676C6520446F6373.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\476f6f676c6520446f6373.ico")) returned 0 [0113.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\476F6F676C6520446F6373.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\476f6f676c6520446f6373.ico")) returned 0x2020 [0113.250] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 0x325098 [0113.250] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 0 [0113.250] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0113.250] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 1 [0113.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 0xffffffff [0113.252] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 1 [0113.252] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0113.252] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.252] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0113.252] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0113.253] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0113.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0113.253] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0113.253] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 0 [0113.253] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0113.253] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x329f28, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 0 [0113.253] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0113.253] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 1 [0113.253] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0113.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0113.253] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0113.254] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0113.254] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.254] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0113.254] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0113.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0113.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\5765622044617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\5765622044617461"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0113.255] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11000 [0113.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0113.255] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0113.345] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x11000, lpOverlapped=0x0) returned 1 [0113.348] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x11010, lpOverlapped=0x0) returned 1 [0113.350] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.381] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.392] CloseHandle (hObject=0x10c) returned 1 [0113.392] CloseHandle (hObject=0x100) returned 1 [0113.392] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\5765622044617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\5765622044617461")) returned 0 [0113.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\5765622044617461" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\5765622044617461")) returned 0x2020 [0113.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 0x325018 [0113.393] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 0 [0113.393] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0113.393] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 1 [0113.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 0xffffffff [0113.394] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 1 [0113.395] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0113.395] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.395] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0113.395] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0113.395] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0113.395] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.395] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0113.395] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0113.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0113.396] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\57656220446174612D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\57656220446174612d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0113.396] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0113.396] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0113.396] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0113.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\57656220446174612D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\57656220446174612d6a6f75726e616c")) returned 0 [0113.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\57656220446174612D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\57656220446174612d6a6f75726e616c")) returned 0x2020 [0113.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 0x325018 [0113.512] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 0 [0113.513] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0113.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal")) returned 1 [0113.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal")) returned 0xffffffff [0113.513] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 0 [0113.513] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.513] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0113.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0113.514] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0113.514] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 0 [0113.514] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.514] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0113.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0113.515] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0113.515] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 0 [0113.515] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.515] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0113.515] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0113.515] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.515] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0113.515] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0113.515] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0113.515] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.515] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0113.516] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0113.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0113.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\46697273742052756E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\46697273742052756e"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0113.517] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0113.517] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0113.517] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0113.659] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\46697273742052756E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\46697273742052756e")) returned 0 [0113.659] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\46697273742052756E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\46697273742052756e")) returned 0x2020 [0113.659] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 0x324fd8 [0113.659] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 0 [0113.659] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.660] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run")) returned 1 [0113.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run")) returned 0xffffffff [0113.660] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0113.660] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0113.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0113.660] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0113.661] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0113.661] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.661] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0113.661] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0113.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0113.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\4C6F63616C205374617465" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\4c6f63616c205374617465"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0113.661] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1082a [0113.661] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0113.662] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0113.751] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1082a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1082a, lpOverlapped=0x0) returned 1 [0113.754] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10830, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x10830, lpOverlapped=0x0) returned 1 [0113.756] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.780] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.790] CloseHandle (hObject=0x10c) returned 1 [0113.790] CloseHandle (hObject=0x104) returned 1 [0113.791] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\4C6F63616C205374617465" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\4c6f63616c205374617465")) returned 0 [0113.791] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\4C6F63616C205374617465" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\4c6f63616c205374617465")) returned 0x2020 [0113.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 0x324fd8 [0113.791] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 0 [0113.791] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.792] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state")) returned 1 [0113.793] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state")) returned 0xffffffff [0113.793] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0113.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0113.793] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 1 [0113.793] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 0 [0113.793] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.793] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0113.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0113.793] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 1 [0113.794] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 0 [0113.794] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.794] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="pnacl", cAlternateFileName="")) returned 1 [0113.794] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0113.794] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 1 [0113.794] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 0 [0113.794] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.804] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0113.804] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0113.804] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.804] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0113.804] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0113.804] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0113.804] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.804] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0113.804] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0113.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0113.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E67204368616E6E656C20494473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e67204368616e6e656c20494473"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0113.806] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1400 [0113.806] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0113.806] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0113.879] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1400, lpOverlapped=0x0) returned 1 [0113.881] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1410, lpOverlapped=0x0) returned 1 [0113.882] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.904] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.915] CloseHandle (hObject=0x104) returned 1 [0113.915] CloseHandle (hObject=0x10c) returned 1 [0113.915] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E67204368616E6E656C20494473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e67204368616e6e656c20494473")) returned 0 [0113.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E67204368616E6E656C20494473" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e67204368616e6e656c20494473")) returned 0x2020 [0113.916] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 0x324fd8 [0113.916] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 0 [0113.916] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0113.916] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids")) returned 1 [0113.917] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids")) returned 0xffffffff [0113.917] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0113.917] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0113.917] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.917] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0113.917] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0113.919] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0113.919] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0113.919] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0113.919] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0113.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0113.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E67204368616E6E656C204944732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e67204368616e6e656c204944732d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0113.920] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0113.920] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0113.921] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0114.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E67204368616E6E656C204944732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e67204368616e6e656c204944732d6a6f75726e616c")) returned 0 [0114.043] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E67204368616E6E656C204944732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e67204368616e6e656c204944732d6a6f75726e616c")) returned 0x2020 [0114.043] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 0x324fd8 [0114.044] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 0 [0114.044] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.044] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal")) returned 1 [0114.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal")) returned 0xffffffff [0114.044] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0114.044] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.044] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.044] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.044] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.045] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.045] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.045] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0114.045] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0114.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E6720436F6F6B696573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e6720436f6f6b696573"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0114.046] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c00 [0114.046] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0114.046] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0114.134] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1c00, lpOverlapped=0x0) returned 1 [0114.135] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1c10, lpOverlapped=0x0) returned 1 [0114.136] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.159] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.170] CloseHandle (hObject=0x104) returned 1 [0114.170] CloseHandle (hObject=0x10c) returned 1 [0114.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E6720436F6F6B696573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e6720436f6f6b696573")) returned 0 [0114.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E6720436F6F6B696573" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e6720436f6f6b696573")) returned 0x2020 [0114.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 0x324fd8 [0114.174] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 0 [0114.174] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.174] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies")) returned 1 [0114.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies")) returned 0xffffffff [0114.175] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0114.176] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.176] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.176] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.176] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.176] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.176] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.176] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0114.176] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0114.177] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E6720436F6F6B6965732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e6720436f6f6b6965732d6a6f75726e616c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0114.177] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0114.177] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0114.178] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0114.309] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E6720436F6F6B6965732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e6720436f6f6b6965732d6a6f75726e616c")) returned 0 [0114.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\536166652042726F7773696E6720436F6F6B6965732D6A6F75726E616C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\536166652042726f7773696e6720436f6f6b6965732d6a6f75726e616c")) returned 0x2020 [0114.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 0x324fd8 [0114.310] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 0 [0114.311] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.311] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal")) returned 1 [0114.311] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal")) returned 0xffffffff [0114.311] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0114.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0114.311] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0114.311] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 0 [0114.311] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.311] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0114.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0114.312] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0114.312] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 0 [0114.312] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.312] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0114.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0114.312] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0114.312] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 0 [0114.312] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.312] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0114.312] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0114.312] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed54, dwReserved1=0x18ed24, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0114.312] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0114.313] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0114.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0114.313] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 1 [0114.313] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 0 [0114.313] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0114.313] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0114.313] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0114.313] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f1f4, cFileName="History", cAlternateFileName="")) returned 1 [0114.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="CrashReports", cAlternateFileName="øÇ1")) returned 0xffffffff [0114.314] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x18f1f4, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0114.314] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.314] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.314] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.314] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.315] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.315] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.315] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f4c) returned 0x10ab [0114.315] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.315] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0114.315] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\49636F6E4361636865.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\49636f6e4361636865.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0114.316] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126775 [0114.316] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0114.317] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0114.420] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x126775, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x126775, lpOverlapped=0x0) returned 1 [0114.455] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x126780, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x126780, lpOverlapped=0x0) returned 1 [0114.478] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.501] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.512] CloseHandle (hObject=0xf4) returned 1 [0114.512] CloseHandle (hObject=0xf8) returned 1 [0114.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\49636F6E4361636865.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\49636f6e4361636865.db")) returned 0 [0114.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\49636F6E4361636865.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\49636f6e4361636865.db")) returned 0x2020 [0114.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 0x324f18 [0114.513] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 0 [0114.513] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0114.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 1 [0114.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 0xffffffff [0114.515] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0114.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x30f830, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0114.515] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x30f830, cFileName="..", cAlternateFileName="")) returned 1 [0114.516] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x30f830, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0114.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0114.516] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 1 [0114.516] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 0 [0114.516] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0114.516] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x30f830, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0114.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0114.517] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 1 [0114.517] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 0 [0114.517] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0114.517] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x30f830, cFileName="Feeds", cAlternateFileName="")) returned 1 [0114.517] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0114.520] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 1 [0114.520] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0114.520] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.520] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.520] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.520] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.520] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e70, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.520] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.520] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e70) returned 0x10ab [0114.521] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.521] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1 [0114.521] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0114.522] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0114.522] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0114.522] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.522] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.522] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.523] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.523] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f68, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.523] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.523] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f68) returned 0x10ab [0114.523] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.523] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1 [0114.523] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.523] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.523] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.523] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.524] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fdc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.524] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.524] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fdc) returned 0x10ab [0114.524] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.524] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1 [0114.524] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.524] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.524] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.524] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.525] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ffc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ffc) returned 0x10ab [0114.525] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.525] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0114.525] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0114.526] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0114.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0114.526] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 1 [0114.526] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0114.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0114.526] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="..", cAlternateFileName="")) returned 1 [0114.526] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 1 [0114.526] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.527] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.527] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fb0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fb0) returned 0x10ab [0114.527] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.527] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1 [0114.527] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.528] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.528] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fb0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.528] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.528] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fb0) returned 0x10ab [0114.528] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.528] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0114.528] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.528] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0 [0114.528] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0114.530] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0114.530] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0114.530] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0114.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0114.532] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="..", cAlternateFileName="")) returned 1 [0114.532] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0114.532] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0114.533] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName="..", cAlternateFileName="")) returned 1 [0114.533] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0114.533] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.533] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.533] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.533] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.533] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.533] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.533] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f8c) returned 0x10ab [0114.533] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0114.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0114.535] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0114.535] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0114.535] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0114.629] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0114.634] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0114.634] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.657] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.669] CloseHandle (hObject=0x104) returned 1 [0114.669] CloseHandle (hObject=0x10c) returned 1 [0114.669] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\6465736b746f70.ini")) returned 0 [0114.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\6465736b746f70.ini")) returned 0x2020 [0114.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0114.670] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0114.670] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.670] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 1 [0114.670] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0xffffffff [0114.671] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0114.671] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.671] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.671] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.671] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.671] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ff8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.671] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.671] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ff8) returned 0x10ab [0114.671] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0114.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\66776c696e6b5b315d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0114.672] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0114.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0114.673] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0114.783] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\66776c696e6b5b315d")) returned 0 [0114.784] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\66776c696e6b5b315d")) returned 0x2020 [0114.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0x324fd8 [0114.784] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0114.784] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.784] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]")) returned 1 [0114.784] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]")) returned 0xffffffff [0114.784] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0114.784] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0114.784] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0114.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0114.785] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.785] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0114.785] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.785] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.785] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.785] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.785] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fd0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.785] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.786] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fd0) returned 0x10ab [0114.786] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0114.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0114.787] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0114.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0114.787] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0114.889] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0114.890] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0114.891] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.913] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.926] CloseHandle (hObject=0x104) returned 1 [0114.926] CloseHandle (hObject=0x10c) returned 1 [0114.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\6465736b746f70.ini")) returned 0 [0114.927] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\6465736b746f70.ini")) returned 0x2020 [0114.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0114.927] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0114.927] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0114.927] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 1 [0114.928] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0xffffffff [0114.928] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0114.928] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0114.928] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.928] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0114.928] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0114.929] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fe4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0114.929] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0114.929] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fe4) returned 0x10ab [0114.929] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0114.929] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0114.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\66776c696e6b5b315d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0114.930] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0114.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0114.931] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0115.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\66776c696e6b5b315d")) returned 0 [0115.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\66776c696e6b5b315d")) returned 0x2020 [0115.055] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0x324fd8 [0115.055] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0115.055] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0115.055] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]")) returned 1 [0115.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]")) returned 0xffffffff [0115.055] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0115.055] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0115.055] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0115.055] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0115.056] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.056] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0115.056] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.056] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.056] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.056] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.056] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.056] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.056] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f84) returned 0x10ab [0115.056] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0115.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0115.057] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0115.057] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0115.058] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0115.146] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0115.147] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0115.148] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.174] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.185] CloseHandle (hObject=0x104) returned 1 [0115.185] CloseHandle (hObject=0x10c) returned 1 [0115.185] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\6465736b746f70.ini")) returned 0 [0115.186] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\6465736b746f70.ini")) returned 0x2020 [0115.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0115.186] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0115.186] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0115.186] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 1 [0115.187] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0xffffffff [0115.187] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0115.187] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.187] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.187] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.187] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.188] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fe8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.188] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.188] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fe8) returned 0x10ab [0115.188] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0115.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\66776c696e6b5b315d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0115.189] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0115.189] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0115.189] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0115.301] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\66776c696e6b5b315d")) returned 0 [0115.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\66776c696e6b5b315d")) returned 0x2020 [0115.301] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0x324fd8 [0115.302] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0115.302] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0115.302] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]")) returned 1 [0115.302] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]")) returned 0xffffffff [0115.302] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0115.302] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0115.302] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0115.302] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.302] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.302] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.302] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.303] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.303] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.303] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0115.303] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0115.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0115.304] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0115.304] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0115.304] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0115.405] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x43, lpOverlapped=0x0) returned 1 [0115.406] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x50, lpOverlapped=0x0) returned 1 [0115.407] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.430] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.441] CloseHandle (hObject=0xfc) returned 1 [0115.441] CloseHandle (hObject=0x104) returned 1 [0115.442] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6465736b746f70.ini")) returned 0 [0115.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6465736b746f70.ini")) returned 0x2020 [0115.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f98 [0115.443] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0115.443] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0115.443] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 1 [0115.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0xffffffff [0115.444] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="index.dat", cAlternateFileName="")) returned 1 [0115.444] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.444] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.444] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.444] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.445] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fcc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.445] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.445] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fcc) returned 0x10ab [0115.445] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0115.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0115.455] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0115.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0115.455] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0115.551] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x8000, lpOverlapped=0x0) returned 1 [0115.553] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x8010, lpOverlapped=0x0) returned 1 [0115.555] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.579] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.611] CloseHandle (hObject=0x104) returned 1 [0115.612] CloseHandle (hObject=0xfc) returned 1 [0115.612] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\696e646578.dat")) returned 0 [0115.612] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\696e646578.dat")) returned 0x2020 [0115.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x324f98 [0115.613] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0115.613] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0115.613] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 1 [0115.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 0xffffffff [0115.614] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0115.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x980096, dwReserved1=0x337f30, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0115.614] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x980096, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 1 [0115.614] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x980096, dwReserved1=0x337f30, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0115.615] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.615] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.615] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.615] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.616] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fcc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.616] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.616] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fcc) returned 0x10ab [0115.616] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0115.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0115.618] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0115.618] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0115.619] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0115.692] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0115.693] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0115.694] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.718] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.729] CloseHandle (hObject=0x104) returned 1 [0115.729] CloseHandle (hObject=0x10c) returned 1 [0115.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\6465736b746f70.ini")) returned 0 [0115.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\6465736b746f70.ini")) returned 0x2020 [0115.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0115.730] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0115.730] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0115.730] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 1 [0115.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0xffffffff [0115.731] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0115.732] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.732] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.732] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.732] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.732] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.732] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.732] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0115.732] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.732] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0115.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\66776c696e6b5b315d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0115.733] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0115.733] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0115.733] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0115.880] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\66776c696e6b5b315d")) returned 0 [0115.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\66776C696E6B5B315D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\66776c696e6b5b315d")) returned 0x2020 [0115.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0x324fd8 [0115.882] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0115.882] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0115.882] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]")) returned 1 [0115.883] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]")) returned 0xffffffff [0115.883] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0115.883] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.883] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.883] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.883] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.884] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.884] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.884] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fb4) returned 0x10ab [0115.884] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.884] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0115.884] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0115.884] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0115.885] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0115.885] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="FORMS", cAlternateFileName="")) returned 1 [0115.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0115.886] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 1 [0115.886] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0115.886] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.886] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.886] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.887] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.887] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.887] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.887] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0115.887] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.887] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0 [0115.887] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0115.887] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IME12", cAlternateFileName="")) returned 1 [0115.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0115.888] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0115.888] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 0 [0115.888] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0115.888] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0115.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0115.890] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0115.890] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 0 [0115.890] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0115.890] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0115.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0115.891] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0115.891] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 0 [0115.891] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0115.891] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0115.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0115.892] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0115.892] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 0 [0115.892] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0115.892] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0115.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0115.894] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0115.894] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0115.894] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0115.894] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.894] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0115.894] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0115.895] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fa4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0115.895] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0115.895] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fa4) returned 0x10ab [0115.895] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0115.895] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0115.895] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\62726E646C6F67.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\62726e646c6f67.bak"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0115.896] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fa9 [0115.896] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0115.896] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0115.990] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x2fa9, lpOverlapped=0x0) returned 1 [0115.992] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x2fb0, lpOverlapped=0x0) returned 1 [0115.993] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.017] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.030] CloseHandle (hObject=0xfc) returned 1 [0116.030] CloseHandle (hObject=0x104) returned 1 [0116.031] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\62726E646C6F67.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\62726e646c6f67.bak")) returned 0 [0116.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\62726E646C6F67.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\62726e646c6f67.bak")) returned 0x2020 [0116.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="brndlog.bak", cAlternateFileName="")) returned 0x324f98 [0116.031] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="brndlog.bak", cAlternateFileName="")) returned 0 [0116.031] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0116.031] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 1 [0116.033] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 0xffffffff [0116.033] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0116.033] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0116.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0116.033] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0116.033] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ff4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0116.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ff4) returned 0x10ab [0116.034] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0116.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0116.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\62726E646C6F67.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\62726e646c6f67.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0116.036] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fb0 [0116.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0116.036] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0116.126] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2fb0, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x2fb0, lpOverlapped=0x0) returned 1 [0116.128] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x2fc0, lpOverlapped=0x0) returned 1 [0116.129] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.153] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.164] CloseHandle (hObject=0x104) returned 1 [0116.164] CloseHandle (hObject=0xfc) returned 1 [0116.164] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\62726E646C6F67.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\62726e646c6f67.txt")) returned 0 [0116.164] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\62726E646C6F67.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\62726e646c6f67.txt")) returned 0x2020 [0116.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="brndlog.txt", cAlternateFileName="")) returned 0x324f98 [0116.165] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="brndlog.txt", cAlternateFileName="")) returned 0 [0116.165] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0116.165] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0116.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0xffffffff [0116.166] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0116.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x326f20, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0116.175] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x326f20, cFileName="..", cAlternateFileName="")) returned 1 [0116.175] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x326f20, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1 [0116.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0116.176] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.176] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0116.176] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0116.176] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x326f20, cFileName="8NES5H33", cAlternateFileName="")) returned 1 [0116.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0116.176] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.176] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1 [0116.176] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0116.176] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.177] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0116.177] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0116.177] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0116.177] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.177] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0116.177] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0116.178] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0116.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0116.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\6765742E61646F62655B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\6765742e61646f62655b315d.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0116.180] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd [0116.180] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0116.180] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0116.263] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xd, lpOverlapped=0x0) returned 1 [0116.264] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x10, lpOverlapped=0x0) returned 1 [0116.264] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.287] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.299] CloseHandle (hObject=0x10c) returned 1 [0116.299] CloseHandle (hObject=0x100) returned 1 [0116.299] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\6765742E61646F62655B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\6765742e61646f62655b315d.xml")) returned 0 [0116.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\6765742E61646F62655B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\6765742e61646f62655b315d.xml")) returned 0x2020 [0116.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0x325018 [0116.300] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0 [0116.300] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0116.300] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml")) returned 1 [0116.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml")) returned 0xffffffff [0116.301] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0 [0116.301] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0116.301] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x326f6c, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1 [0116.301] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0116.302] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0116.302] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 0 [0116.302] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0116.302] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x6d782e5d, dwReserved1=0x326f6c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0116.302] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0116.302] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.302] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0116.302] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2833c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0116.302] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.302] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2833c) returned 0x10ab [0116.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0116.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0116.305] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0116.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0116.305] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0116.410] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x8000, lpOverlapped=0x0) returned 1 [0116.412] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x8010, lpOverlapped=0x0) returned 1 [0116.414] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.437] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.449] CloseHandle (hObject=0x104) returned 1 [0116.449] CloseHandle (hObject=0x100) returned 1 [0116.449] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\696e646578.dat")) returned 0 [0116.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\696e646578.dat")) returned 0x2020 [0116.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x324fd8 [0116.450] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0116.450] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0116.450] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat")) returned 1 [0116.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat")) returned 0xffffffff [0116.451] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1 [0116.451] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0116.451] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0116.451] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 0 [0116.451] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0116.451] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0 [0116.451] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0116.451] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1 [0116.452] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0116.452] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.452] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0116.452] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28778, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0116.452] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.452] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28778) returned 0x10ab [0116.452] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0116.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\6672616D6569636F6E6361636865.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\6672616d6569636f6e6361636865.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0116.454] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23f4 [0116.454] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0116.454] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0116.547] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x23f4, lpOverlapped=0x0) returned 1 [0116.549] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x2400, lpOverlapped=0x0) returned 1 [0116.550] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.585] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.596] CloseHandle (hObject=0xfc) returned 1 [0116.596] CloseHandle (hObject=0x100) returned 1 [0116.596] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\6672616D6569636F6E6361636865.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\6672616d6569636f6e6361636865.dat")) returned 0 [0116.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\6672616D6569636F6E6361636865.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\6672616d6569636f6e6361636865.dat")) returned 0x2020 [0116.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 0x324f98 [0116.597] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 0 [0116.597] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0116.597] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 1 [0116.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 0xffffffff [0116.599] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0116.599] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0116.599] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.599] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0116.599] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28b54, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0116.599] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.599] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28b54) returned 0x10ab [0116.599] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Recovery", cAlternateFileName="")) returned 1 [0116.599] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0116.600] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0116.600] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="Active", cAlternateFileName="")) returned 1 [0116.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0116.600] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0116.600] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 0 [0116.600] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0116.600] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0116.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0116.604] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0116.604] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1 [0116.605] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0116.605] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.605] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0116.605] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28da0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0116.605] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.605] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28da0) returned 0x10ab [0116.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0116.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\5265636F7665727953746F72652E7B34424436353046312D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\5265636f7665727953746f72652e7b34424436353046312d433846392d313145372d423542462d4334334443373538344130307d.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0116.606] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe00 [0116.606] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0116.606] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0116.681] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xe00, lpOverlapped=0x0) returned 1 [0116.683] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xe10, lpOverlapped=0x0) returned 1 [0116.684] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.707] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.718] CloseHandle (hObject=0x104) returned 1 [0116.718] CloseHandle (hObject=0x10c) returned 1 [0116.718] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\5265636F7665727953746F72652E7B34424436353046312D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\5265636f7665727953746f72652e7b34424436353046312d433846392d313145372d423542462d4334334443373538344130307d.dat")) returned 0 [0116.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\5265636F7665727953746F72652E7B34424436353046312D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\5265636f7665727953746f72652e7b34424436353046312d433846392d313145372d423542462d4334334443373538344130307d.dat")) returned 0x2020 [0116.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 0x325018 [0116.719] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 0 [0116.719] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0116.719] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0116.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0xffffffff [0116.720] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1 [0116.720] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0116.720] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.720] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0116.720] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29444, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0116.720] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.721] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29444) returned 0x10ab [0116.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0116.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\5265636F7665727953746F72652E7B41414536424635432D343939312D313145372D384532422D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\5265636f7665727953746f72652e7b41414536424635432d343939312d313145372d384532422d4334334443373538344130307d.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0116.721] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1200 [0116.721] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0116.722] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0116.810] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1200, lpOverlapped=0x0) returned 1 [0116.812] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1210, lpOverlapped=0x0) returned 1 [0116.813] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.837] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.848] CloseHandle (hObject=0x10c) returned 1 [0116.848] CloseHandle (hObject=0x104) returned 1 [0116.848] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\5265636F7665727953746F72652E7B41414536424635432D343939312D313145372D384532422D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\5265636f7665727953746f72652e7b41414536424635432d343939312d313145372d384532422d4334334443373538344130307d.dat")) returned 0 [0116.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\5265636F7665727953746F72652E7B41414536424635432D343939312D313145372D384532422D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\5265636f7665727953746f72652e7b41414536424635432d343939312d313145372d384532422d4334334443373538344130307d.dat")) returned 0x2020 [0116.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 0x325018 [0116.849] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 0 [0116.849] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0116.849] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat")) returned 1 [0116.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat")) returned 0xffffffff [0116.850] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1 [0116.850] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0116.850] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.850] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0116.850] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2986c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0116.850] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0116.850] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2986c) returned 0x10ab [0116.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0116.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\7B34424436353046302D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\7b34424436353046302d433846392d313145372d423542462d4334334443373538344130307d.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0116.865] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1200 [0116.865] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0116.866] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0116.956] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1200, lpOverlapped=0x0) returned 1 [0116.979] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1210, lpOverlapped=0x0) returned 1 [0116.980] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.004] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.015] CloseHandle (hObject=0x104) returned 1 [0117.015] CloseHandle (hObject=0x10c) returned 1 [0117.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\7B34424436353046302D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\7b34424436353046302d433846392d313145372d423542462d4334334443373538344130307d.dat")) returned 0 [0117.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\7B34424436353046302D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\7b34424436353046302d433846392d313145372d423542462d4334334443373538344130307d.dat")) returned 0x2020 [0117.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 0x325018 [0117.016] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 0 [0117.016] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0117.016] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0117.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0xffffffff [0117.017] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1 [0117.017] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.017] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.017] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ed4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.017] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ed4) returned 0x10ab [0117.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0117.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\7B36393531323135352D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\7b36393531323135352d433846392d313145372d423542462d4334334443373538344130307d.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0117.019] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1200 [0117.019] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0117.020] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0117.119] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1200, lpOverlapped=0x0) returned 1 [0117.135] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1210, lpOverlapped=0x0) returned 1 [0117.138] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.162] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.176] CloseHandle (hObject=0x10c) returned 1 [0117.176] CloseHandle (hObject=0x104) returned 1 [0117.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\7B36393531323135352D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\7b36393531323135352d433846392d313145372d423542462d4334334443373538344130307d.dat")) returned 0 [0117.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\7B36393531323135352D433846392D313145372D423542462D4334334443373538344130307D.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\7b36393531323135352d433846392d313145372d423542462d4334334443373538344130307d.dat")) returned 0x2020 [0117.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0x325018 [0117.182] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0 [0117.182] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0117.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0117.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0xffffffff [0117.183] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0 [0117.183] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0117.183] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0 [0117.184] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.184] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Recovery", cAlternateFileName="")) returned 0 [0117.184] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0117.184] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656854, dwReserved1=0x42746164, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0117.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0117.188] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0117.188] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0117.191] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.192] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.194] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.194] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.194] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.194] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f28) returned 0x10ab [0117.194] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0117.195] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.195] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.195] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.195] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f68, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.195] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.195] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f68) returned 0x10ab [0117.195] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0117.195] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0117.195] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0117.195] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="en-US", cAlternateFileName="")) returned 1 [0117.195] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0117.196] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.196] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1 [0117.196] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0117.198] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.198] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0117.198] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.198] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.198] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.198] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c281a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.198] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.198] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c281a4) returned 0x10ab [0117.199] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0117.199] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.199] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.199] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c282b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.199] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c282b0) returned 0x10ab [0117.199] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0117.199] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.199] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.199] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c283b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.199] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c283b0) returned 0x10ab [0117.199] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0117.199] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.199] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.200] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c284bc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.200] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.200] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c284bc) returned 0x10ab [0117.200] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0117.200] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.200] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.200] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.200] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c285cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.200] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.200] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c285cc) returned 0x10ab [0117.200] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0117.200] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.200] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.200] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.200] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c286cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.200] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.200] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c286cc) returned 0x10ab [0117.201] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0117.201] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.201] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.201] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.201] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c287d0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.201] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.201] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c287d0) returned 0x10ab [0117.201] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0117.201] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.201] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.201] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.201] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c288d0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.201] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.201] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c288d0) returned 0x10ab [0117.201] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0117.201] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.201] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.201] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.202] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c289c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.202] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.202] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c289c4) returned 0x10ab [0117.202] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0117.202] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.202] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.202] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.202] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28a94, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.202] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.202] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28a94) returned 0x10ab [0117.202] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0117.202] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.202] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.202] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.202] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28b68, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.202] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.202] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28b68) returned 0x10ab [0117.202] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0117.203] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.203] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.203] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.203] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28c38, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.203] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.203] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28c38) returned 0x10ab [0117.203] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0117.203] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0117.204] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70772e6f, dwReserved1=0x6c70776c, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0117.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName=".", cAlternateFileName="")) returned 0x325018 [0117.206] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="..", cAlternateFileName="")) returned 1 [0117.206] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0117.206] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.206] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.206] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.206] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28d50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.206] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.206] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28d50) returned 0x10ab [0117.206] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0117.206] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.206] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.207] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.207] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a310, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.207] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.207] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a310) returned 0x10ab [0117.207] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0117.207] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.207] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.207] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.207] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28c50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.207] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.207] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28c50) returned 0x10ab [0117.207] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0117.208] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.208] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.208] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.208] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a310, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.208] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.208] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a310) returned 0x10ab [0117.208] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0117.208] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.208] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.208] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.208] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28c50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.208] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.208] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28c50) returned 0x10ab [0117.208] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0117.209] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.209] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a310, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a310) returned 0x10ab [0117.209] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0117.209] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.209] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28c50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28c50) returned 0x10ab [0117.210] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0117.210] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.210] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.210] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.210] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a310, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.210] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.210] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a310) returned 0x10ab [0117.210] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0117.210] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.210] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.210] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.210] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28c50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.210] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28c50) returned 0x10ab [0117.211] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0117.211] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.211] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.211] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a310, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.211] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a310) returned 0x10ab [0117.211] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0117.211] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.211] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.212] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28c50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.212] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.212] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28c50) returned 0x10ab [0117.212] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0117.212] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.212] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.212] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.212] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a310, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.212] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.212] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a310) returned 0x10ab [0117.212] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0117.212] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0117.213] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70772e6f, dwReserved1=0x6c70776c, cFileName="00010C6E", cAlternateFileName="")) returned 0 [0117.213] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0117.213] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="en-US", cAlternateFileName="")) returned 0 [0117.214] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.214] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1 [0117.214] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0117.215] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0117.215] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 0 [0117.215] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.215] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0 [0117.215] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0117.215] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="Office", cAlternateFileName="")) returned 1 [0117.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0117.216] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0117.216] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="14.0", cAlternateFileName="")) returned 1 [0117.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0117.217] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0117.217] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1 [0117.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0117.218] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.218] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1 [0117.218] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.218] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.218] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.218] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.218] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.218] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc4) returned 0x10ab [0117.219] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1 [0117.219] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.219] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.219] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.219] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a434, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.219] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.219] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a434) returned 0x10ab [0117.219] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1 [0117.219] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.219] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.219] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.219] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.219] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.219] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc4) returned 0x10ab [0117.220] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0 [0117.220] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0117.220] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0 [0117.220] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.220] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18ed24, cFileName="Groove", cAlternateFileName="")) returned 1 [0117.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0117.220] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0117.220] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="System", cAlternateFileName="")) returned 1 [0117.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0117.221] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="..", cAlternateFileName="")) returned 1 [0117.221] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="..", cAlternateFileName="")) returned 0 [0117.221] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0117.221] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="User", cAlternateFileName="")) returned 1 [0117.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0117.221] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="..", cAlternateFileName="")) returned 1 [0117.221] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="..", cAlternateFileName="")) returned 0 [0117.222] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0117.222] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="User", cAlternateFileName="")) returned 0 [0117.222] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.222] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18ed24, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1 [0117.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0117.222] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0117.222] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1 [0117.222] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.222] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.222] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.222] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a338, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.223] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.223] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a338) returned 0x10ab [0117.223] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1 [0117.223] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.223] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.223] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.223] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.223] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.223] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e74) returned 0x10ab [0117.223] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0117.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\3335306462393564663463626439346232613163333030353130653132653131.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\3335306462393564663463626439346232613163333030353130653132653131.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0117.228] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ef [0117.228] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0117.229] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0117.310] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7ef, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x7ef, lpOverlapped=0x0) returned 1 [0117.311] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x7f0, lpOverlapped=0x0) returned 1 [0117.312] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.335] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.348] CloseHandle (hObject=0xfc) returned 1 [0117.348] CloseHandle (hObject=0x104) returned 1 [0117.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\3335306462393564663463626439346232613163333030353130653132653131.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\3335306462393564663463626439346232613163333030353130653132653131.xml")) returned 0 [0117.349] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\3335306462393564663463626439346232613163333030353130653132653131.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\3335306462393564663463626439346232613163333030353130653132653131.xml")) returned 0x2020 [0117.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0x324fd8 [0117.349] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0 [0117.349] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0117.349] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml")) returned 1 [0117.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml")) returned 0xffffffff [0117.351] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0 [0117.351] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.351] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18ed24, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0 [0117.351] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0117.351] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="Outlook", cAlternateFileName="")) returned 1 [0117.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0117.352] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="..", cAlternateFileName="")) returned 1 [0117.352] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1 [0117.352] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.352] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.352] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.352] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2827c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.352] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.352] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2827c) returned 0x10ab [0117.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0117.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\6D617069737663.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\6d617069737663.inf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0117.355] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x462 [0117.355] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0117.355] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0117.454] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x462, lpOverlapped=0x0) returned 1 [0117.455] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x470, lpOverlapped=0x0) returned 1 [0117.456] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.480] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.493] CloseHandle (hObject=0x100) returned 1 [0117.493] CloseHandle (hObject=0x104) returned 1 [0117.493] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\6D617069737663.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\6d617069737663.inf")) returned 0 [0117.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\6D617069737663.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\6d617069737663.inf")) returned 0x2020 [0117.494] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 0x324f98 [0117.494] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 0 [0117.494] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.494] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf")) returned 1 [0117.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf")) returned 0xffffffff [0117.495] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1 [0117.495] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.495] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.495] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.495] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28518, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.495] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.495] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28518) returned 0x10ab [0117.496] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0117.496] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0117.496] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0117.496] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0117.496] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.496] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.496] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.496] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c286e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.496] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.496] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c286e4) returned 0x10ab [0117.496] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0117.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\53747265616D5F436F6E7461637450726566735F325F4632333045313139333642374437343041303038464643363630453833433731.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\53747265616d5f436f6e7461637450726566735f325f4632333045313139333642374437343041303038464643363630453833433731.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0117.499] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0117.499] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0117.499] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0117.626] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x104, lpOverlapped=0x0) returned 1 [0117.627] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0117.628] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.656] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.668] CloseHandle (hObject=0x100) returned 1 [0117.669] CloseHandle (hObject=0xfc) returned 1 [0117.669] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\53747265616D5F436F6E7461637450726566735F325F4632333045313139333642374437343041303038464643363630453833433731.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\53747265616d5f436f6e7461637450726566735f325f4632333045313139333642374437343041303038464643363630453833433731.dat")) returned 0 [0117.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\53747265616D5F436F6E7461637450726566735F325F4632333045313139333642374437343041303038464643363630453833433731.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\53747265616d5f436f6e7461637450726566735f325f4632333045313139333642374437343041303038464643363630453833433731.dat")) returned 0x2020 [0117.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x324fd8 [0117.670] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0117.670] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0117.670] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat")) returned 1 [0117.670] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat")) returned 0xffffffff [0117.671] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0117.671] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.671] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0 [0117.671] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0117.671] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0117.671] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0117.673] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0117.673] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 0 [0117.673] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0117.673] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0117.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0117.674] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0117.674] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 0 [0117.674] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0117.674] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="Visio", cAlternateFileName="")) returned 1 [0117.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0117.675] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0117.675] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0117.675] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.675] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.675] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.675] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28dd0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.675] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.675] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28dd0) returned 0x10ab [0117.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0117.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\636F6E74656E743134.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\636f6e74656e743134.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0117.676] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ce0 [0117.676] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0117.676] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0117.756] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18ce0, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x18ce0, lpOverlapped=0x0) returned 1 [0117.760] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18cf0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x18cf0, lpOverlapped=0x0) returned 1 [0117.763] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.785] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.796] CloseHandle (hObject=0x104) returned 1 [0117.796] CloseHandle (hObject=0xfc) returned 1 [0117.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\636F6E74656E743134.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\636f6e74656e743134.dat")) returned 0 [0117.797] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\636F6E74656E743134.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\636f6e74656e743134.dat")) returned 0x2020 [0117.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 0x324f98 [0117.797] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 0 [0117.797] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.797] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat")) returned 1 [0117.799] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat")) returned 0xffffffff [0117.799] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="thumbs.dat", cAlternateFileName="")) returned 1 [0117.799] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0117.799] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.799] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0117.799] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29084, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0117.799] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0117.799] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29084) returned 0x10ab [0117.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0117.800] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\7468756D6273.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\7468756d6273.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0117.800] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f400 [0117.800] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0117.800] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0117.912] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f400, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x1f400, lpOverlapped=0x0) returned 1 [0117.923] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f410, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x1f410, lpOverlapped=0x0) returned 1 [0117.926] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.952] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.963] CloseHandle (hObject=0xfc) returned 1 [0117.963] CloseHandle (hObject=0x104) returned 1 [0117.963] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\7468756D6273.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\7468756d6273.dat")) returned 0 [0117.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\7468756D6273.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\7468756d6273.dat")) returned 0x2020 [0117.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0x324f98 [0117.964] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0 [0117.964] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.964] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat")) returned 1 [0117.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat")) returned 0xffffffff [0117.965] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="thumbs.dat", cAlternateFileName="")) returned 0 [0117.965] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0117.966] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e7461, dwReserved1=0x6c6d782e, cFileName="Windows", cAlternateFileName="")) returned 1 [0117.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0117.966] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0117.966] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="1024", cAlternateFileName="")) returned 1 [0117.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x337f30, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0117.974] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 1 [0117.974] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 0 [0117.974] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0117.974] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="1033", cAlternateFileName="")) returned 1 [0117.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x337f30, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0118.018] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x337f30, cFileName="..", cAlternateFileName="")) returned 1 [0118.018] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x8e008c, dwReserved1=0x337f30, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0118.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0118.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0118.018] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0118.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc4) returned 0x10ab [0118.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0118.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\537472756374757265645175657279536368656D61.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\537472756374757265645175657279536368656d61.bin"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0118.019] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49098 [0118.019] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0118.020] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0118.121] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x49098, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x49098, lpOverlapped=0x0) returned 1 [0118.134] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x490a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x490a0, lpOverlapped=0x0) returned 1 [0118.140] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.162] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.190] CloseHandle (hObject=0xfc) returned 1 [0118.190] CloseHandle (hObject=0x100) returned 1 [0118.190] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\537472756374757265645175657279536368656D61.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\537472756374757265645175657279536368656d61.bin")) returned 0 [0118.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\537472756374757265645175657279536368656D61.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\537472756374757265645175657279536368656d61.bin")) returned 0x2020 [0118.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0x324fd8 [0118.191] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0118.191] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0118.191] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 1 [0118.194] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 0xffffffff [0118.194] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x8e008c, dwReserved1=0x337f30, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0118.194] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0118.194] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Burn", cAlternateFileName="")) returned 1 [0118.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0118.194] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0118.194] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Burn", cAlternateFileName="")) returned 1 [0118.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba00b8, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0118.195] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba00b8, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0118.195] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xba00b8, dwReserved1=0x31e3e0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.195] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0118.195] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.195] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0118.195] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2814c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0118.195] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.195] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2814c) returned 0x10ab [0118.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0118.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0118.196] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0118.196] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0118.197] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0118.316] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xae, lpOverlapped=0x0) returned 1 [0118.316] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xb0, lpOverlapped=0x0) returned 1 [0118.317] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.352] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.363] CloseHandle (hObject=0xfc) returned 1 [0118.363] CloseHandle (hObject=0x10c) returned 1 [0118.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\6465736b746f70.ini")) returned 0 [0118.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\6465736b746f70.ini")) returned 0x20 [0118.364] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0118.364] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0118.364] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0118.364] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 1 [0118.382] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0xffffffff [0118.382] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xba00b8, dwReserved1=0x31e3e0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0118.382] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0118.382] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Burn1", cAlternateFileName="")) returned 1 [0118.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0118.383] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.383] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.383] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0118.383] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.383] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0118.383] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c297b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0118.383] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.383] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c297b0) returned 0x10ab [0118.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0118.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0118.384] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0118.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0118.385] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0118.511] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xae, lpOverlapped=0x0) returned 1 [0118.511] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xb0, lpOverlapped=0x0) returned 1 [0118.512] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.535] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.552] CloseHandle (hObject=0x10c) returned 1 [0118.552] CloseHandle (hObject=0xfc) returned 1 [0118.556] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\6465736b746f70.ini")) returned 0 [0118.557] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\6465736b746f70.ini")) returned 0x20 [0118.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0118.557] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0118.557] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0118.557] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 1 [0118.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 0xffffffff [0118.558] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0118.558] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0118.558] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Burn2", cAlternateFileName="")) returned 1 [0118.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0118.603] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.603] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.604] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0118.604] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.604] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0118.604] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28114, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0118.604] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.604] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28114) returned 0x10ab [0118.604] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0118.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0118.619] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0118.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0118.620] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0118.706] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xae, lpOverlapped=0x0) returned 1 [0118.707] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xb0, lpOverlapped=0x0) returned 1 [0118.708] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.731] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.742] CloseHandle (hObject=0xfc) returned 1 [0118.742] CloseHandle (hObject=0x10c) returned 1 [0118.742] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\6465736b746f70.ini")) returned 0 [0118.743] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\6465736b746f70.ini")) returned 0x20 [0118.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0118.743] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0118.743] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0118.743] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 1 [0118.744] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 0xffffffff [0118.744] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0118.744] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0118.744] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Burn2", cAlternateFileName="")) returned 0 [0118.744] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0118.744] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Caches", cAlternateFileName="")) returned 1 [0118.744] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0118.744] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0118.744] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0118.745] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0118.745] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.745] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0118.745] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29a70, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0118.745] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.745] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29a70) returned 0x10ab [0118.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0118.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\6376657273696F6E732E31.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\6376657273696f6e732e31.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0118.746] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0118.746] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0118.746] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0118.838] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x4000, lpOverlapped=0x0) returned 1 [0118.839] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x4010, lpOverlapped=0x0) returned 1 [0118.840] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.879] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.891] CloseHandle (hObject=0x100) returned 1 [0118.892] CloseHandle (hObject=0x10c) returned 1 [0118.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\6376657273696F6E732E31.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\6376657273696f6e732e31.db")) returned 0 [0118.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\6376657273696F6E732E31.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\6376657273696f6e732e31.db")) returned 0x2020 [0118.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 0x324fd8 [0118.894] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 0 [0118.894] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0118.894] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 1 [0118.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0xffffffff [0118.896] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1 [0118.896] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0118.897] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.897] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0118.897] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c281ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0118.897] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0118.897] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c281ec) returned 0x10ab [0118.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0118.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\7B41464246394631412D384545382D344337372D414633342D4336343745333743413044397D2E312E766572307830303030303030303030303030303135.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\7b41464246394631412d384545382d344337372d414633342d4336343745333743413044397d2e312e766572307830303030303030303030303030303135.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0118.899] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18388 [0118.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0118.899] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0118.991] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18388, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18388, lpOverlapped=0x0) returned 1 [0118.995] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x18390, lpOverlapped=0x0) returned 1 [0118.997] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.021] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.031] CloseHandle (hObject=0x10c) returned 1 [0119.032] CloseHandle (hObject=0x100) returned 1 [0119.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\7B41464246394631412D384545382D344337372D414633342D4336343745333743413044397D2E312E766572307830303030303030303030303030303135.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\7b41464246394631412d384545382d344337372d414633342d4336343745333743413044397d2e312e766572307830303030303030303030303030303135.db")) returned 0 [0119.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\7B41464246394631412D384545382D344337372D414633342D4336343745333743413044397D2E312E766572307830303030303030303030303030303135.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\7b41464246394631412d384545382d344337372d414633342d4336343745333743413044397d2e312e766572307830303030303030303030303030303135.db")) returned 0x2020 [0119.032] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 0x324fd8 [0119.033] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 0 [0119.033] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0119.033] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db")) returned 1 [0119.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db")) returned 0xffffffff [0119.034] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1 [0119.034] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0119.034] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.035] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0119.035] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29fa8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0119.035] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.035] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29fa8) returned 0x10ab [0119.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0119.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\7B41464246394631412D384545382D344337372D414633342D4336343745333743413044397D2E312E766572307830303030303030303030303030303136.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\7b41464246394631412d384545382d344337372d414633342d4336343745333743413044397d2e312e766572307830303030303030303030303030303136.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0119.036] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ea08 [0119.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0119.037] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0119.126] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ea08, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1ea08, lpOverlapped=0x0) returned 1 [0119.357] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1ea10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1ea10, lpOverlapped=0x0) returned 1 [0119.362] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.405] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.417] CloseHandle (hObject=0x100) returned 1 [0119.417] CloseHandle (hObject=0x10c) returned 1 [0119.417] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\7B41464246394631412D384545382D344337372D414633342D4336343745333743413044397D2E312E766572307830303030303030303030303030303136.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\7b41464246394631412d384545382d344337372d414633342d4336343745333743413044397d2e312e766572307830303030303030303030303030303136.db")) returned 0 [0119.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\7B41464246394631412D384545382D344337372D414633342D4336343745333743413044397D2E312E766572307830303030303030303030303030303136.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\7b41464246394631412d384545382d344337372d414633342d4336343745333743413044397d2e312e766572307830303030303030303030303030303136.db")) returned 0x2020 [0119.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0x324fd8 [0119.419] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0 [0119.419] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0119.419] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")) returned 0 [0119.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")) returned 0x2020 [0119.419] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0 [0119.419] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0119.419] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d384545, dwReserved1=0x37374334, cFileName="Explorer", cAlternateFileName="")) returned 1 [0119.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0119.420] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0119.420] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0119.420] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0119.420] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.420] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0119.420] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a08c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0119.420] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.420] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a08c) returned 0x10ab [0119.420] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54aad4c0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0119.421] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0119.421] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.421] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0119.421] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a17c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0119.421] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.421] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a17c) returned 0x10ab [0119.421] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0119.421] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0119.421] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.421] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0119.421] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a234, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0119.421] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.421] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a234) returned 0x10ab [0119.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0119.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F31303234.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f31303234.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0119.423] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0119.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0119.423] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0119.462] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0119.463] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0119.464] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.486] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.497] CloseHandle (hObject=0x10c) returned 1 [0119.497] CloseHandle (hObject=0x100) returned 1 [0119.498] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F31303234.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f31303234.db")) returned 0 [0119.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F31303234.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f31303234.db")) returned 0x2020 [0119.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 0x324fd8 [0119.498] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 0 [0119.498] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0119.498] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 1 [0119.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 0xffffffff [0119.500] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0119.500] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0119.500] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.500] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0119.500] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0119.500] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.500] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc4) returned 0x10ab [0119.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0119.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F323536.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f323536.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0119.501] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0119.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0119.502] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0119.536] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0119.564] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0119.586] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.640] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.651] CloseHandle (hObject=0x100) returned 1 [0119.651] CloseHandle (hObject=0x10c) returned 1 [0119.651] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F323536.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f323536.db")) returned 0 [0119.652] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F323536.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f323536.db")) returned 0x2020 [0119.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 0x324fd8 [0119.652] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 0 [0119.652] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0119.653] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 1 [0119.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0xffffffff [0119.666] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0119.667] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0119.667] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.667] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0119.667] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28194, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0119.667] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.667] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28194) returned 0x10ab [0119.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0119.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F3332.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f3332.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0119.668] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0119.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0119.669] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0119.703] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0119.704] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0119.705] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.728] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.739] CloseHandle (hObject=0x10c) returned 1 [0119.739] CloseHandle (hObject=0x100) returned 1 [0119.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F3332.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f3332.db")) returned 0 [0119.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F3332.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f3332.db")) returned 0x2020 [0119.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 0x324fd8 [0119.740] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 0 [0119.740] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0119.740] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 1 [0119.741] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0xffffffff [0119.741] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0119.741] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0119.741] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.741] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0119.741] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a900, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0119.741] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.741] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a900) returned 0x10ab [0119.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0119.742] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F3936.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f3936.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0119.742] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0119.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0119.743] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0119.778] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0119.806] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0119.829] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.852] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.863] CloseHandle (hObject=0x100) returned 1 [0119.863] CloseHandle (hObject=0x10c) returned 1 [0119.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F3936.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f3936.db")) returned 0 [0119.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F3936.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f3936.db")) returned 0x2020 [0119.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 0x324fd8 [0119.864] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 0 [0119.864] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0119.864] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 1 [0119.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0xffffffff [0119.872] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0119.873] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0119.873] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.873] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0119.873] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2818c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0119.873] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0119.873] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2818c) returned 0x10ab [0119.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0119.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F696478.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f696478.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0119.874] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb8 [0119.874] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0119.874] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0119.979] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcb8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xcb8, lpOverlapped=0x0) returned 1 [0119.979] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xcc0, lpOverlapped=0x0) returned 1 [0119.981] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.004] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.015] CloseHandle (hObject=0x10c) returned 1 [0120.015] CloseHandle (hObject=0x100) returned 1 [0120.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F696478.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f696478.db")) returned 0 [0120.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F696478.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f696478.db")) returned 0x2020 [0120.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 0x324fd8 [0120.016] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 0 [0120.016] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0120.016] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 1 [0120.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0xffffffff [0120.017] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1 [0120.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.018] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a3a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a3a8) returned 0x10ab [0120.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0120.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F7372.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f7372.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0120.020] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0120.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0120.020] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0120.114] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0120.115] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0120.116] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.139] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.151] CloseHandle (hObject=0x100) returned 1 [0120.151] CloseHandle (hObject=0x10c) returned 1 [0120.151] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F7372.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f7372.db")) returned 0 [0120.152] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\7468756D6263616368655F7372.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\7468756d6263616368655f7372.db")) returned 0x2020 [0120.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0x324fd8 [0120.152] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0 [0120.152] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0120.152] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 1 [0120.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0xffffffff [0120.153] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0 [0120.153] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0120.153] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0120.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0120.154] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.154] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0120.154] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0120.154] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="History", cAlternateFileName="")) returned 1 [0120.154] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0120.154] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.155] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0120.155] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.155] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a3a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a3a8) returned 0x10ab [0120.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0120.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0120.156] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0120.156] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0120.156] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0120.248] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x91, lpOverlapped=0x0) returned 1 [0120.249] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa0, lpOverlapped=0x0) returned 1 [0120.250] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.273] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.284] CloseHandle (hObject=0x10c) returned 1 [0120.284] CloseHandle (hObject=0x100) returned 1 [0120.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\6465736b746f70.ini")) returned 0 [0120.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\6465736b746f70.ini")) returned 0x2020 [0120.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0120.285] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0120.285] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0120.285] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 1 [0120.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0xffffffff [0120.286] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa11a0fb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0120.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa11a0fb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x326f20, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0120.286] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa11a0fb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x326f20, cFileName="..", cAlternateFileName="")) returned 1 [0120.286] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0xa400a2, dwReserved1=0x326f20, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0120.287] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.287] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29684, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29684) returned 0x10ab [0120.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0120.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0120.288] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0120.288] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0120.288] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0120.405] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x91, lpOverlapped=0x0) returned 1 [0120.407] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xa0, lpOverlapped=0x0) returned 1 [0120.411] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.433] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.447] CloseHandle (hObject=0x10c) returned 1 [0120.448] CloseHandle (hObject=0xfc) returned 1 [0120.450] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\6465736b746f70.ini")) returned 0 [0120.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\6465736b746f70.ini")) returned 0x2020 [0120.451] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0120.451] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0120.451] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0120.451] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 1 [0120.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0120.452] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="index.dat", cAlternateFileName="")) returned 1 [0120.455] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.455] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.458] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.458] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29860, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.458] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.458] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29860) returned 0x10ab [0120.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.458] CloseHandle (hObject=0xffffffff) returned 0 [0120.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\696e646578.dat")) returned 0 [0120.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\696e646578.dat")) returned 0xffffffff [0120.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325018 [0120.459] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0120.459] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0120.459] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 0 [0120.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 0x2026 [0120.459] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa11a0fb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa11a0fb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1 [0120.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa11a0fb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa11a0fb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x325018 [0120.459] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa11a0fb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa11a0fb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0120.459] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa11a0fb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xb800b6, dwReserved1=0x329f28, cFileName="index.dat", cAlternateFileName="")) returned 1 [0120.459] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.459] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.459] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.460] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29a54, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.460] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.460] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29a54) returned 0x10ab [0120.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.460] CloseHandle (hObject=0xffffffff) returned 0 [0120.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\696e646578.dat")) returned 0 [0120.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\696e646578.dat")) returned 0xffffffff [0120.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\index.dat", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa11a0fb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325058 [0120.460] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa11a0fb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0120.460] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0120.460] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\index.dat")) returned 0 [0120.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\index.dat")) returned 0x2026 [0120.460] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa11a0fb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xb800b6, dwReserved1=0x329f28, cFileName="index.dat", cAlternateFileName="")) returned 0 [0120.461] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0120.461] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa11a0fb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa11a0fb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa11a0fb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 0 [0120.461] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0120.461] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="Low", cAlternateFileName="")) returned 1 [0120.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0120.461] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.461] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0120.461] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.461] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29e84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29e84) returned 0x10ab [0120.461] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0120.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0120.463] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0120.463] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0120.464] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0120.538] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x91, lpOverlapped=0x0) returned 1 [0120.539] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xa0, lpOverlapped=0x0) returned 1 [0120.539] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.562] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.574] CloseHandle (hObject=0xfc) returned 1 [0120.574] CloseHandle (hObject=0x10c) returned 1 [0120.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\6465736b746f70.ini")) returned 0 [0120.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\6465736b746f70.ini")) returned 0x2020 [0120.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0120.575] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0120.575] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0120.575] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 1 [0120.576] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 0xffffffff [0120.576] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0120.576] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x335f48, cFileName=".", cAlternateFileName="")) returned 0x325018 [0120.576] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x335f48, cFileName="..", cAlternateFileName="")) returned 1 [0120.576] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0xac00aa, dwReserved1=0x335f48, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0120.576] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.576] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.577] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.577] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a1e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.577] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.577] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a1e4) returned 0x10ab [0120.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0120.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0120.580] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0120.580] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0120.580] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0120.674] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x91, lpOverlapped=0x0) returned 1 [0120.675] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xa0, lpOverlapped=0x0) returned 1 [0120.676] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.699] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.710] CloseHandle (hObject=0xfc) returned 1 [0120.710] CloseHandle (hObject=0x110) returned 1 [0120.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\6465736b746f70.ini")) returned 0 [0120.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\6465736b746f70.ini")) returned 0x2020 [0120.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325058 [0120.711] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0120.711] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0120.711] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 1 [0120.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 0xffffffff [0120.712] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="index.dat", cAlternateFileName="")) returned 1 [0120.713] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.713] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.713] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.713] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.713] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.713] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a514) returned 0x10ab [0120.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0120.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0120.714] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0120.714] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0120.714] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0120.803] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x8000, lpOverlapped=0x0) returned 1 [0120.805] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x8010, lpOverlapped=0x0) returned 1 [0120.806] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.829] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.840] CloseHandle (hObject=0x110) returned 1 [0120.840] CloseHandle (hObject=0xfc) returned 1 [0120.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\696e646578.dat")) returned 0 [0120.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\696e646578.dat")) returned 0x2020 [0120.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325058 [0120.841] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0120.841] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0120.841] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat")) returned 1 [0120.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat")) returned 0xffffffff [0120.842] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1 [0120.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0120.843] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0120.843] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xc000be, dwReserved1=0x31e3e0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0120.843] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0120.843] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.843] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0120.843] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a740, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0120.843] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0120.843] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a740) returned 0x10ab [0120.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0120.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0120.845] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0120.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0120.845] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0120.951] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x8000, lpOverlapped=0x0) returned 1 [0120.961] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8010, lpOverlapped=0x0) returned 1 [0120.963] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.986] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.997] CloseHandle (hObject=0x110) returned 1 [0120.997] CloseHandle (hObject=0x108) returned 1 [0120.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\696e646578.dat")) returned 0 [0120.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\696e646578.dat")) returned 0x2020 [0120.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325098 [0120.998] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0120.998] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0120.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat")) returned 1 [0121.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat")) returned 0xffffffff [0121.000] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xc000be, dwReserved1=0x31e3e0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0121.000] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0121.000] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0 [0121.000] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0121.000] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0121.000] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0121.000] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="Low", cAlternateFileName="")) returned 0 [0121.000] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0121.000] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0121.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0121.001] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="..", cAlternateFileName="")) returned 1 [0121.001] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="..", cAlternateFileName="")) returned 0 [0121.001] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0121.001] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0121.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0121.002] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="..", cAlternateFileName="")) returned 1 [0121.002] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0121.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0121.002] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName="..", cAlternateFileName="")) returned 1 [0121.002] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.002] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.002] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.002] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.002] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c293ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.002] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.002] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c293ec) returned 0x10ab [0121.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0121.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0121.004] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0121.004] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0121.004] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0121.070] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x43, lpOverlapped=0x0) returned 1 [0121.071] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x50, lpOverlapped=0x0) returned 1 [0121.072] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.094] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.106] CloseHandle (hObject=0x10c) returned 1 [0121.106] CloseHandle (hObject=0xfc) returned 1 [0121.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\6465736b746f70.ini")) returned 0 [0121.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\6465736b746f70.ini")) returned 0x2020 [0121.107] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0121.107] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.107] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0121.107] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0121.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0121.108] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa1fc3250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="index.dat", cAlternateFileName="")) returned 1 [0121.108] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.108] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.108] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.108] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c296d0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.108] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.108] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c296d0) returned 0x10ab [0121.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.109] CloseHandle (hObject=0xffffffff) returned 0 [0121.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\696e646578.dat")) returned 0 [0121.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\696e646578.dat")) returned 0xffffffff [0121.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa1fc3250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325018 [0121.109] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa1fc3250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0121.109] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0121.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 0 [0121.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 0x2026 [0121.109] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0121.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xda00d8, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0121.111] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xda00d8, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0121.111] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xda00d8, dwReserved1=0x31e3e0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.111] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.111] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.112] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abe8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.112] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abe8) returned 0x10ab [0121.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0121.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0121.113] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0121.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0121.113] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0121.207] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0121.208] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0121.209] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.232] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.243] CloseHandle (hObject=0x10c) returned 1 [0121.243] CloseHandle (hObject=0x108) returned 1 [0121.243] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\6465736b746f70.ini")) returned 0 [0121.244] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\6465736b746f70.ini")) returned 0x2020 [0121.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325058 [0121.244] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.244] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0121.244] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 1 [0121.245] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0xffffffff [0121.245] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xda00d8, dwReserved1=0x31e3e0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.245] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0121.245] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0121.245] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0121.247] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0121.247] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.247] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.247] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.247] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.247] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aefc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.247] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.247] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aefc) returned 0x10ab [0121.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0121.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0121.248] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0121.248] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0121.249] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0121.339] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0121.340] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0121.341] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.387] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.398] CloseHandle (hObject=0x108) returned 1 [0121.398] CloseHandle (hObject=0x10c) returned 1 [0121.399] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\6465736b746f70.ini")) returned 0 [0121.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\6465736b746f70.ini")) returned 0x2020 [0121.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325058 [0121.399] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.400] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0121.400] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 1 [0121.400] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0xffffffff [0121.401] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.401] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0121.401] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0121.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0121.403] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0121.403] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.403] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.403] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.403] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.403] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29c7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.403] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.403] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29c7c) returned 0x10ab [0121.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0121.404] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0121.404] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0121.404] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0121.405] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0121.479] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0121.480] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0121.481] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.503] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.514] CloseHandle (hObject=0x10c) returned 1 [0121.514] CloseHandle (hObject=0x108) returned 1 [0121.515] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\6465736b746f70.ini")) returned 0 [0121.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\6465736b746f70.ini")) returned 0x2020 [0121.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325058 [0121.515] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.515] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0121.516] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 1 [0121.517] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0xffffffff [0121.517] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.517] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0121.517] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0121.517] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0121.519] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0121.519] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.519] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.519] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.519] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.519] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.519] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.519] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a088) returned 0x10ab [0121.520] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0121.520] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0121.520] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0121.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0121.521] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0121.644] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0121.645] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0121.646] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.668] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.679] CloseHandle (hObject=0x108) returned 1 [0121.679] CloseHandle (hObject=0x10c) returned 1 [0121.680] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\6465736b746f70.ini")) returned 0 [0121.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\6465736b746f70.ini")) returned 0x2020 [0121.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325058 [0121.680] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.680] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0121.681] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 1 [0121.681] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0xffffffff [0121.681] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.681] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0121.682] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0121.682] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0121.682] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0121.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0121.693] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0121.693] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 0 [0121.693] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0121.695] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0121.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0121.696] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0121.696] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 0 [0121.696] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0121.696] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x30313030, dwReserved1=0x32303238, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.696] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.696] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.696] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.696] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a56c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.696] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.697] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a56c) returned 0x10ab [0121.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0121.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0121.698] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0121.698] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0121.698] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0121.788] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0121.789] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0121.790] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.813] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.824] CloseHandle (hObject=0x100) returned 1 [0121.824] CloseHandle (hObject=0xfc) returned 1 [0121.824] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\6465736b746f70.ini")) returned 0 [0121.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\6465736b746f70.ini")) returned 0x2020 [0121.825] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0121.825] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.825] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0121.825] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 1 [0121.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0xffffffff [0121.826] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Low", cAlternateFileName="")) returned 1 [0121.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0121.826] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0121.826] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31e3e0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1 [0121.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325018 [0121.827] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0121.827] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1 [0121.827] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.827] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.827] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.827] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29318, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.827] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.827] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29318) returned 0x10ab [0121.827] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0121.827] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\32434544424642432D444241382D343341412D423146442D434338453633313645334532.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\32434544424642432d444241382d343341412d423146442d434338453633313645334532.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0121.829] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47f94 [0121.829] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0121.830] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0121.903] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x47f94, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x47f94, lpOverlapped=0x0) returned 1 [0121.913] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x47fa0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x47fa0, lpOverlapped=0x0) returned 1 [0121.937] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.971] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.982] CloseHandle (hObject=0x10c) returned 1 [0121.982] CloseHandle (hObject=0x108) returned 1 [0121.982] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\32434544424642432D444241382D343341412D423146442D434338453633313645334532.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\32434544424642432d444241382d343341412d423146442d434338453633313645334532.dat")) returned 0 [0121.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\32434544424642432D444241382D343341412D423146442D434338453633313645334532.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\32434544424642432d444241382d343341412d423146442d434338453633313645334532.dat")) returned 0x2020 [0121.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0x325058 [0121.983] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0 [0121.983] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0121.983] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat")) returned 1 [0121.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat")) returned 0xffffffff [0121.986] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0 [0121.986] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0121.986] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3841, dwReserved1=0x2d414133, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0121.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325018 [0121.987] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0121.987] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1 [0121.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1220120, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0121.989] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1220120, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0121.990] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdc03670, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x39d41, dwReserved0=0x1220120, dwReserved1=0x31e3e0, cFileName="28-8f3193-f30905ea[1]", cAlternateFileName="28-8F3~1")) returned 1 [0121.991] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.991] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.991] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.991] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac2c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.991] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.991] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac2c) returned 0x10ab [0121.991] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 1 [0121.991] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0121.991] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.991] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0121.991] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0121.991] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0121.991] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad00) returned 0x10ab [0121.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0121.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\35323864383261325B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\35323864383261325b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0121.993] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ecb [0121.993] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0121.993] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0122.068] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2ecb, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2ecb, lpOverlapped=0x0) returned 1 [0122.069] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2ed0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2ed0, lpOverlapped=0x0) returned 1 [0122.071] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.093] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.104] CloseHandle (hObject=0x10c) returned 1 [0122.104] CloseHandle (hObject=0x110) returned 1 [0122.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\35323864383261325B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\35323864383261325b315d.js")) returned 0 [0122.105] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\35323864383261325B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\35323864383261325b315d.js")) returned 0x2020 [0122.105] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 0x325098 [0122.105] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 0 [0122.105] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0122.105] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js")) returned 1 [0122.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js")) returned 0xffffffff [0122.106] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 1 [0122.107] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0122.107] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.107] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0122.107] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0122.107] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0122.107] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.107] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0122.107] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0122.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0122.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414133653358435B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414133653358435b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0122.109] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135 [0122.109] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0122.109] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0122.206] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x135, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x135, lpOverlapped=0x0) returned 1 [0122.209] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x140, lpOverlapped=0x0) returned 1 [0122.210] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.234] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.245] CloseHandle (hObject=0x110) returned 1 [0122.245] CloseHandle (hObject=0x10c) returned 1 [0122.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414133653358435B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414133653358435b325d.png")) returned 0 [0122.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414133653358435B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414133653358435b325d.png")) returned 0x2020 [0122.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 0x325098 [0122.246] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 0 [0122.247] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0122.247] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 1 [0122.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 0xffffffff [0122.248] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 1 [0122.248] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0122.248] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.249] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0122.249] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0122.249] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0122.249] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.249] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0122.249] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0122.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0122.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414133764F56415B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414133764f56415b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0122.252] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28e [0122.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0122.252] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0122.344] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x28e, lpOverlapped=0x0) returned 1 [0122.346] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x290, lpOverlapped=0x0) returned 1 [0122.347] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.380] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.392] CloseHandle (hObject=0x10c) returned 1 [0122.392] CloseHandle (hObject=0x110) returned 1 [0122.392] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414133764F56415B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414133764f56415b315d.png")) returned 0 [0122.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414133764F56415B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414133764f56415b315d.png")) returned 0x2020 [0122.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 0x325098 [0122.393] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 0 [0122.393] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0122.393] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 1 [0122.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 0xffffffff [0122.394] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 1 [0122.394] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0122.394] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.394] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0122.394] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab78, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0122.394] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.394] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab78) returned 0x10ab [0122.394] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0122.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414134324550395B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414134324550395b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0122.395] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cd [0122.395] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0122.396] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0122.470] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1cd, lpOverlapped=0x0) returned 1 [0122.472] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1d0, lpOverlapped=0x0) returned 1 [0122.477] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.500] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.511] CloseHandle (hObject=0x110) returned 1 [0122.511] CloseHandle (hObject=0x10c) returned 1 [0122.511] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414134324550395B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414134324550395b315d.png")) returned 0 [0122.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414134324550395B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414134324550395b315d.png")) returned 0x2020 [0122.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 0x325098 [0122.512] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 0 [0122.512] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0122.512] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 1 [0122.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 0xffffffff [0122.513] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 1 [0122.514] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0122.514] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.514] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0122.514] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aeb8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0122.514] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.514] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aeb8) returned 0x10ab [0122.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0122.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4141353472516A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4141353472516a5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0122.515] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x191 [0122.515] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0122.515] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0122.605] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x191, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x191, lpOverlapped=0x0) returned 1 [0122.607] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1a0, lpOverlapped=0x0) returned 1 [0122.608] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.631] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.642] CloseHandle (hObject=0x10c) returned 1 [0122.642] CloseHandle (hObject=0x110) returned 1 [0122.642] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4141353472516A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4141353472516a5b315d.png")) returned 0 [0122.643] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4141353472516A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4141353472516a5b315d.png")) returned 0x2020 [0122.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 0x325098 [0122.643] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 0 [0122.643] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0122.643] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 1 [0122.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 0xffffffff [0122.644] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 1 [0122.645] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0122.645] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.645] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0122.645] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0122.645] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0122.645] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.645] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0122.645] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0122.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0122.646] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414136317969395B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414136317969395b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0122.647] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19d [0122.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0122.647] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0122.765] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x19d, lpOverlapped=0x0) returned 1 [0122.768] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1a0, lpOverlapped=0x0) returned 1 [0122.769] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.795] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.806] CloseHandle (hObject=0x110) returned 1 [0122.806] CloseHandle (hObject=0x10c) returned 1 [0122.806] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414136317969395B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414136317969395b315d.png")) returned 0 [0122.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\414136317969395B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\414136317969395b315d.png")) returned 0x2020 [0122.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 0x325098 [0122.808] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 0 [0122.808] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0122.808] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 1 [0122.809] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 0xffffffff [0122.809] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 1 [0122.810] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0122.810] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.810] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0122.810] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0122.810] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b094, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0122.810] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.810] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b094) returned 0x10ab [0122.811] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0122.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0122.813] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\41413875436F345B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\41413875436f345b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0122.813] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c8 [0122.813] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0122.814] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0122.889] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2c8, lpOverlapped=0x0) returned 1 [0122.891] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d0, lpOverlapped=0x0) returned 1 [0122.892] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.915] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.927] CloseHandle (hObject=0x10c) returned 1 [0122.927] CloseHandle (hObject=0x110) returned 1 [0122.927] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\41413875436F345B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\41413875436f345b315d.png")) returned 0 [0122.928] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\41413875436F345B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\41413875436f345b315d.png")) returned 0x2020 [0122.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 0x325098 [0122.928] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 0 [0122.928] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0122.928] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 1 [0122.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 0xffffffff [0122.929] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 1 [0122.930] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0122.930] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.930] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0122.930] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0122.930] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0122.930] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abb4) returned 0x10ab [0122.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0122.931] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4141644156724D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4141644156724d5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0122.931] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x342 [0122.932] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0122.932] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0123.034] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x342, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x342, lpOverlapped=0x0) returned 1 [0123.041] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x350, lpOverlapped=0x0) returned 1 [0123.042] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.068] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.079] CloseHandle (hObject=0x110) returned 1 [0123.079] CloseHandle (hObject=0x10c) returned 1 [0123.079] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4141644156724D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4141644156724d5b315d.png")) returned 0 [0123.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4141644156724D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4141644156724d5b315d.png")) returned 0x2020 [0123.080] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 0x325098 [0123.080] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 0 [0123.080] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0123.080] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 1 [0123.081] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 0xffffffff [0123.081] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 1 [0123.081] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.081] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.082] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.082] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0123.082] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b03c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.082] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.082] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b03c) returned 0x10ab [0123.082] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0123.082] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0123.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\61645365727665725B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\61645365727665725b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0123.084] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21e7 [0123.084] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0123.084] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0123.175] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x21e7, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x21e7, lpOverlapped=0x0) returned 1 [0123.177] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x21f0, lpOverlapped=0x0) returned 1 [0123.178] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.201] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.212] CloseHandle (hObject=0x10c) returned 1 [0123.212] CloseHandle (hObject=0x110) returned 1 [0123.212] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\61645365727665725B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\61645365727665725b315d.htm")) returned 0 [0123.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\61645365727665725B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\61645365727665725b315d.htm")) returned 0x2020 [0123.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 0x325098 [0123.213] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 0 [0123.213] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0123.213] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm")) returned 1 [0123.214] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm")) returned 0xffffffff [0123.214] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 1 [0123.214] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.214] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.214] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.214] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0123.215] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b03c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.215] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.215] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b03c) returned 0x10ab [0123.215] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0123.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0123.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6164766572746973656D656E742E61645B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6164766572746973656d656e742e61645b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0123.218] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c [0123.218] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0123.218] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0123.308] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c, lpOverlapped=0x0) returned 1 [0123.309] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x20, lpOverlapped=0x0) returned 1 [0123.311] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.335] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.346] CloseHandle (hObject=0x110) returned 1 [0123.346] CloseHandle (hObject=0x10c) returned 1 [0123.346] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6164766572746973656D656E742E61645B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6164766572746973656d656e742e61645b315d.js")) returned 0 [0123.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6164766572746973656D656E742E61645B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6164766572746973656d656e742e61645b315d.js")) returned 0x2020 [0123.347] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 0x325098 [0123.347] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 0 [0123.347] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0123.347] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js")) returned 1 [0123.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js")) returned 0xffffffff [0123.348] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545d0030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545d0030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x545d0030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0123.348] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.348] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.348] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.348] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adb0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.348] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.348] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adb0) returned 0x10ab [0123.349] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x534, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="async_usersync[2]", cAlternateFileName="ASYNC_~2")) returned 1 [0123.349] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.349] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.349] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.349] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aeec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.349] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.349] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aeec) returned 0x10ab [0123.349] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="async_usersync[3]", cAlternateFileName="ASYNC_~3")) returned 1 [0123.349] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.349] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.349] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.349] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0123.349] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.349] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.350] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0123.350] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0123.350] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 1 [0123.350] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.350] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.350] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.350] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac88, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.350] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.350] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac88) returned 0x10ab [0123.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0123.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42423143634F695B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42423143634f695b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0123.351] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d0 [0123.351] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0123.351] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0123.446] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1d0, lpOverlapped=0x0) returned 1 [0123.447] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1e0, lpOverlapped=0x0) returned 1 [0123.448] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.472] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.483] CloseHandle (hObject=0x10c) returned 1 [0123.483] CloseHandle (hObject=0x110) returned 1 [0123.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42423143634F695B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42423143634f695b315d.png")) returned 0 [0123.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42423143634F695B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42423143634f695b315d.png")) returned 0x2020 [0123.484] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 0x325098 [0123.484] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 0 [0123.484] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0123.484] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 1 [0123.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 0xffffffff [0123.485] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 1 [0123.485] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.486] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0123.486] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afe4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afe4) returned 0x10ab [0123.486] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0123.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0123.487] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424234364A6D4E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424234364a6d4e5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0123.488] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x310 [0123.488] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0123.488] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0123.594] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x310, lpOverlapped=0x0) returned 1 [0123.595] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x320, lpOverlapped=0x0) returned 1 [0123.597] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.619] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.631] CloseHandle (hObject=0x110) returned 1 [0123.631] CloseHandle (hObject=0x10c) returned 1 [0123.631] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424234364A6D4E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424234364a6d4e5b315d.png")) returned 0 [0123.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424234364A6D4E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424234364a6d4e5b315d.png")) returned 0x2020 [0123.632] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 0x325098 [0123.632] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 0 [0123.632] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0123.632] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 1 [0123.633] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 0xffffffff [0123.633] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 1 [0123.633] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.633] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.633] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.633] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0123.634] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b100, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.634] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.634] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b100) returned 0x10ab [0123.634] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0123.634] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0123.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242356B4A41435B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242356b4a41435b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0123.635] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120 [0123.635] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0123.636] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0123.725] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x120, lpOverlapped=0x0) returned 1 [0123.727] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x130, lpOverlapped=0x0) returned 1 [0123.728] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.760] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.774] CloseHandle (hObject=0x10c) returned 1 [0123.774] CloseHandle (hObject=0x110) returned 1 [0123.776] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242356B4A41435B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242356b4a41435b315d.png")) returned 0 [0123.777] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242356B4A41435B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242356b4a41435b315d.png")) returned 0x2020 [0123.777] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 0x325098 [0123.777] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 0 [0123.778] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0123.778] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 1 [0123.779] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 0xffffffff [0123.779] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 1 [0123.782] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.782] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.784] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.784] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0123.785] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b084, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.785] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.785] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b084) returned 0x10ab [0123.785] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0123.785] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0123.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242356B5469565B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242356b5469565b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0123.787] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121 [0123.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0123.787] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0123.862] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x121, lpOverlapped=0x0) returned 1 [0123.864] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x130, lpOverlapped=0x0) returned 1 [0123.865] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.888] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.899] CloseHandle (hObject=0x110) returned 1 [0123.899] CloseHandle (hObject=0x10c) returned 1 [0123.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242356B5469565B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242356b5469565b315d.png")) returned 0 [0123.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242356B5469565B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242356b5469565b315d.png")) returned 0x2020 [0123.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 0x325098 [0123.900] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 0 [0123.900] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0123.900] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 1 [0123.901] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 0xffffffff [0123.901] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 1 [0123.901] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0123.901] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.901] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0123.901] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0123.902] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b084, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0123.902] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0123.902] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b084) returned 0x10ab [0123.902] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0123.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0123.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242364D6134615B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242364d6134615b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0123.903] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18c [0123.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0123.903] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0124.004] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x18c, lpOverlapped=0x0) returned 1 [0124.005] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x190, lpOverlapped=0x0) returned 1 [0124.006] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.029] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.040] CloseHandle (hObject=0x10c) returned 1 [0124.040] CloseHandle (hObject=0x110) returned 1 [0124.041] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242364D6134615B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242364d6134615b315d.png")) returned 0 [0124.041] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242364D6134615B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242364d6134615b315d.png")) returned 0x2020 [0124.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 0x325098 [0124.041] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 0 [0124.041] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0124.042] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 1 [0124.042] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 0xffffffff [0124.042] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 1 [0124.043] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0124.043] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.043] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0124.043] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0124.043] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.043] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac6c) returned 0x10ab [0124.043] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0124.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42423734664C735B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42423734664c735b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0124.045] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x168 [0124.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0124.045] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0124.135] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x168, lpOverlapped=0x0) returned 1 [0124.142] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x170, lpOverlapped=0x0) returned 1 [0124.143] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.166] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.178] CloseHandle (hObject=0x110) returned 1 [0124.178] CloseHandle (hObject=0x10c) returned 1 [0124.178] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42423734664C735B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42423734664c735b315d.png")) returned 0 [0124.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42423734664C735B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42423734664c735b315d.png")) returned 0x2020 [0124.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 0x325098 [0124.179] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 0 [0124.179] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0124.179] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 1 [0124.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 0xffffffff [0124.180] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 1 [0124.180] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0124.180] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.180] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0124.180] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0124.181] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0124.181] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.181] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0124.181] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0124.181] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0124.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242497171385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242497171385b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0124.183] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x333f [0124.183] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0124.183] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0124.273] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x333f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x333f, lpOverlapped=0x0) returned 1 [0124.274] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3340, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3340, lpOverlapped=0x0) returned 1 [0124.276] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.298] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.310] CloseHandle (hObject=0x10c) returned 1 [0124.310] CloseHandle (hObject=0x110) returned 1 [0124.310] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242497171385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242497171385b315d.jpg")) returned 0 [0124.311] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242497171385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242497171385b315d.jpg")) returned 0x2020 [0124.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 0x325098 [0124.311] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 0 [0124.311] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0124.311] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 1 [0124.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 0xffffffff [0124.312] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 1 [0124.313] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0124.313] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.313] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0124.313] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aee4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0124.313] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.313] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aee4) returned 0x10ab [0124.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0124.314] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424C30696A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424c30696a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0124.314] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x90b [0124.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0124.315] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0124.408] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x90b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x90b, lpOverlapped=0x0) returned 1 [0124.409] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x910, lpOverlapped=0x0) returned 1 [0124.410] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.435] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.446] CloseHandle (hObject=0x110) returned 1 [0124.446] CloseHandle (hObject=0x10c) returned 1 [0124.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424C30696A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424c30696a5b315d.jpg")) returned 0 [0124.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424C30696A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424c30696a5b315d.jpg")) returned 0x2020 [0124.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 0x325098 [0124.448] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 0 [0124.448] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0124.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 1 [0124.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 0xffffffff [0124.449] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 1 [0124.450] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0124.450] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.450] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0124.450] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0124.450] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0124.450] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.450] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0124.450] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0124.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0124.452] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424C685A585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424c685a585b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0124.452] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x994 [0124.452] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0124.453] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0124.570] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x994, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x994, lpOverlapped=0x0) returned 1 [0124.571] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9a0, lpOverlapped=0x0) returned 1 [0124.573] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.609] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.622] CloseHandle (hObject=0x10c) returned 1 [0124.622] CloseHandle (hObject=0x110) returned 1 [0124.622] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424C685A585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424c685a585b315d.jpg")) returned 0 [0124.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424C685A585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424c685a585b315d.jpg")) returned 0x2020 [0124.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 0x325098 [0124.623] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 0 [0124.623] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0124.623] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 1 [0124.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 0xffffffff [0124.624] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 1 [0124.625] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0124.625] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.625] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0124.625] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0124.625] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0124.625] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.625] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0124.625] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0124.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0124.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424E69456F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424e69456f5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0124.644] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28b9 [0124.644] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0124.644] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0124.722] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x28b9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x28b9, lpOverlapped=0x0) returned 1 [0124.724] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x28c0, lpOverlapped=0x0) returned 1 [0124.725] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.748] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.759] CloseHandle (hObject=0x110) returned 1 [0124.759] CloseHandle (hObject=0x10c) returned 1 [0124.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424E69456F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424e69456f5b315d.jpg")) returned 0 [0124.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424E69456F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424e69456f5b315d.jpg")) returned 0x2020 [0124.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 0x325098 [0124.760] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 0 [0124.761] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0124.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 1 [0124.762] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 0xffffffff [0124.762] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1 [0124.762] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0124.762] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.762] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0124.762] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9d4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0124.762] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9d4) returned 0x10ab [0124.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0124.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F316D515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f316d515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0124.764] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176d [0124.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0124.764] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0124.854] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x176d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x176d, lpOverlapped=0x0) returned 1 [0124.856] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1770, lpOverlapped=0x0) returned 1 [0124.857] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.880] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.891] CloseHandle (hObject=0x10c) returned 1 [0124.891] CloseHandle (hObject=0x110) returned 1 [0124.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F316D515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f316d515b315d.jpg")) returned 0 [0124.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F316D515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f316d515b315d.jpg")) returned 0x2020 [0124.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0x325098 [0124.892] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0 [0124.892] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0124.892] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 1 [0124.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 0xffffffff [0124.893] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 1 [0124.893] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0124.893] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.893] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0124.893] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae34, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0124.893] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0124.893] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae34) returned 0x10ab [0124.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0124.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F33746C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f33746c5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0124.894] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6218 [0124.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0124.895] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0124.987] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6218, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6218, lpOverlapped=0x0) returned 1 [0124.999] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6220, lpOverlapped=0x0) returned 1 [0125.000] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.023] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.034] CloseHandle (hObject=0x110) returned 1 [0125.034] CloseHandle (hObject=0x10c) returned 1 [0125.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F33746C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f33746c5b315d.jpg")) returned 0 [0125.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F33746C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f33746c5b315d.jpg")) returned 0x2020 [0125.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 0x325098 [0125.035] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 0 [0125.035] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0125.035] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 1 [0125.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 0xffffffff [0125.036] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 1 [0125.037] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0125.037] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.037] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0125.037] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0125.037] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0125.037] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.037] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0125.037] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0125.037] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0125.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F3864515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f3864515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0125.039] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x75a [0125.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0125.039] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0125.131] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x75a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x75a, lpOverlapped=0x0) returned 1 [0125.139] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x760, lpOverlapped=0x0) returned 1 [0125.140] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.162] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.174] CloseHandle (hObject=0x10c) returned 1 [0125.174] CloseHandle (hObject=0x110) returned 1 [0125.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F3864515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f3864515b315d.jpg")) returned 0 [0125.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F3864515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f3864515b315d.jpg")) returned 0x2020 [0125.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 0x325098 [0125.175] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 0 [0125.175] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0125.175] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 1 [0125.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 0xffffffff [0125.176] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 1 [0125.176] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0125.176] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.176] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0125.176] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0125.177] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0125.177] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.177] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0125.177] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0125.177] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0125.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F6537435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f6537435b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0125.178] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d89 [0125.178] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0125.178] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0125.253] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d89, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2d89, lpOverlapped=0x0) returned 1 [0125.255] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d90, lpOverlapped=0x0) returned 1 [0125.256] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.279] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.290] CloseHandle (hObject=0x110) returned 1 [0125.290] CloseHandle (hObject=0x10c) returned 1 [0125.291] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F6537435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f6537435b315d.jpg")) returned 0 [0125.292] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242424F6537435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242424f6537435b315d.jpg")) returned 0x2020 [0125.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 0x325098 [0125.292] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 0 [0125.292] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0125.292] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 1 [0125.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 0xffffffff [0125.293] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 1 [0125.294] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0125.294] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0125.294] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9d4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0125.294] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9d4) returned 0x10ab [0125.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0125.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425054684E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425054684e5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0125.295] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e36 [0125.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0125.296] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0125.402] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e36, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1e36, lpOverlapped=0x0) returned 1 [0125.404] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e40, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1e40, lpOverlapped=0x0) returned 1 [0125.405] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.431] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.445] CloseHandle (hObject=0x10c) returned 1 [0125.445] CloseHandle (hObject=0x110) returned 1 [0125.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425054684E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425054684e5b315d.jpg")) returned 0 [0125.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425054684E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425054684e5b315d.jpg")) returned 0x2020 [0125.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 0x325098 [0125.446] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 0 [0125.447] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0125.447] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 1 [0125.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 0xffffffff [0125.448] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 1 [0125.448] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0125.448] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.448] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0125.448] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac30, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0125.448] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.449] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac30) returned 0x10ab [0125.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0125.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425055464A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425055464a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0125.450] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ee7 [0125.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0125.450] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0125.530] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ee7, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1ee7, lpOverlapped=0x0) returned 1 [0125.532] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1ef0, lpOverlapped=0x0) returned 1 [0125.533] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.556] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.567] CloseHandle (hObject=0x110) returned 1 [0125.567] CloseHandle (hObject=0x10c) returned 1 [0125.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425055464A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425055464a5b315d.jpg")) returned 0 [0125.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425055464A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425055464a5b315d.jpg")) returned 0x2020 [0125.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 0x325098 [0125.568] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 0 [0125.568] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0125.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 1 [0125.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 0xffffffff [0125.569] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 1 [0125.570] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0125.570] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.570] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0125.570] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0125.570] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0125.570] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.570] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0125.570] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0125.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0125.586] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424251787A785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424251787a785b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0125.587] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x924 [0125.587] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0125.588] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0125.678] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x924, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x924, lpOverlapped=0x0) returned 1 [0125.680] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x930, lpOverlapped=0x0) returned 1 [0125.681] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.704] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.715] CloseHandle (hObject=0x10c) returned 1 [0125.715] CloseHandle (hObject=0x110) returned 1 [0125.715] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424251787A785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424251787a785b315d.jpg")) returned 0 [0125.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424251787A785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424251787a785b315d.jpg")) returned 0x2020 [0125.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 0x325098 [0125.717] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 0 [0125.717] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0125.717] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 1 [0125.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 0xffffffff [0125.718] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 1 [0125.720] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0125.720] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.720] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0125.720] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0125.721] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0125.721] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.721] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0125.721] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0125.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0125.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424273654D505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424273654d505b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0125.722] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1963 [0125.722] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0125.723] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0125.812] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1963, lpOverlapped=0x0) returned 1 [0125.814] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1970, lpOverlapped=0x0) returned 1 [0125.815] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.841] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.853] CloseHandle (hObject=0x110) returned 1 [0125.853] CloseHandle (hObject=0x10c) returned 1 [0125.854] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424273654D505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424273654d505b315d.jpg")) returned 0 [0125.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424273654D505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424273654d505b315d.jpg")) returned 0x2020 [0125.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 0x325098 [0125.855] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 0 [0125.855] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0125.855] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 1 [0125.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 0xffffffff [0125.857] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 1 [0125.857] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0125.857] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.858] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0125.858] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0125.858] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.858] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac44) returned 0x10ab [0125.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0125.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424273714E4C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424273714e4c5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0125.859] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16d6 [0125.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0125.859] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0125.951] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16d6, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x16d6, lpOverlapped=0x0) returned 1 [0125.953] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x16e0, lpOverlapped=0x0) returned 1 [0125.955] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.978] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.989] CloseHandle (hObject=0x10c) returned 1 [0125.989] CloseHandle (hObject=0x110) returned 1 [0125.990] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424273714E4C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424273714e4c5b315d.jpg")) returned 0 [0125.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424273714E4C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424273714e4c5b315d.jpg")) returned 0x2020 [0125.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 0x325098 [0125.990] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 0 [0125.990] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0125.990] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 1 [0125.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 0xffffffff [0125.991] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 1 [0125.992] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0125.992] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.992] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0125.992] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0125.992] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0125.992] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af44) returned 0x10ab [0125.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0125.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242547076575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242547076575b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0125.994] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ae [0125.994] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0125.994] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0126.082] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7ae, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7ae, lpOverlapped=0x0) returned 1 [0126.140] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7b0, lpOverlapped=0x0) returned 1 [0126.143] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.172] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.185] CloseHandle (hObject=0x110) returned 1 [0126.185] CloseHandle (hObject=0x10c) returned 1 [0126.185] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242547076575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242547076575b315d.jpg")) returned 0 [0126.186] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242547076575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242547076575b315d.jpg")) returned 0x2020 [0126.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 0x325098 [0126.187] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 0 [0126.187] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0126.187] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 1 [0126.188] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 0xffffffff [0126.188] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1 [0126.189] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0126.189] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.189] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0126.189] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0126.189] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0126.189] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.189] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b8) returned 0x10ab [0126.189] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0126.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0126.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256454F575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256454f575b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0126.193] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x974 [0126.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0126.193] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0126.247] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x974, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x974, lpOverlapped=0x0) returned 1 [0126.248] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x980, lpOverlapped=0x0) returned 1 [0126.249] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.272] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.284] CloseHandle (hObject=0x10c) returned 1 [0126.284] CloseHandle (hObject=0x110) returned 1 [0126.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256454F575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256454f575b315d.jpg")) returned 0 [0126.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256454F575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256454f575b315d.jpg")) returned 0x2020 [0126.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0x325098 [0126.285] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0 [0126.285] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0126.285] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 1 [0126.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 0xffffffff [0126.286] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 1 [0126.286] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0126.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0126.286] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0126.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e4) returned 0x10ab [0126.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0126.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425647734D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425647734d5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0126.287] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e67 [0126.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0126.288] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0126.323] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e67, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1e67, lpOverlapped=0x0) returned 1 [0126.325] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1e70, lpOverlapped=0x0) returned 1 [0126.326] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.349] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.385] CloseHandle (hObject=0x110) returned 1 [0126.385] CloseHandle (hObject=0x10c) returned 1 [0126.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425647734D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425647734d5b315d.jpg")) returned 0 [0126.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242425647734D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242425647734d5b315d.jpg")) returned 0x2020 [0126.386] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 0x325098 [0126.386] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 0 [0126.386] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0126.386] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 1 [0126.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 0xffffffff [0126.387] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 1 [0126.387] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0126.388] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.388] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0126.388] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac24, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0126.388] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.388] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac24) returned 0x10ab [0126.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0126.390] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256497A495B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256497a495b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0126.391] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa8 [0126.391] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0126.391] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0126.475] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaa8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xaa8, lpOverlapped=0x0) returned 1 [0126.477] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xab0, lpOverlapped=0x0) returned 1 [0126.481] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.504] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.517] CloseHandle (hObject=0x10c) returned 1 [0126.517] CloseHandle (hObject=0x110) returned 1 [0126.517] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256497A495B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256497a495b315d.jpg")) returned 0 [0126.518] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256497A495B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256497a495b315d.jpg")) returned 0x2020 [0126.518] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 0x325098 [0126.518] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 0 [0126.518] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0126.518] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 1 [0126.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 0xffffffff [0126.519] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 1 [0126.520] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0126.520] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.520] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0126.520] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0126.520] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0126.520] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.520] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0126.520] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0126.520] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0126.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242564A34725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242564a34725b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0126.531] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97a [0126.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0126.532] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0126.647] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x97a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x97a, lpOverlapped=0x0) returned 1 [0126.676] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x980, lpOverlapped=0x0) returned 1 [0126.677] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.703] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.716] CloseHandle (hObject=0x110) returned 1 [0126.716] CloseHandle (hObject=0x10c) returned 1 [0126.716] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242564A34725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242564a34725b315d.jpg")) returned 0 [0126.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424242564A34725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424242564a34725b315d.jpg")) returned 0x2020 [0126.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 0x325098 [0126.717] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 0 [0126.717] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0126.717] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 1 [0126.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 0xffffffff [0126.718] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 1 [0126.718] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0126.719] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.719] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0126.719] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0126.719] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0126.719] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.719] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0126.719] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0126.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0126.720] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256784D385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256784d385b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0126.720] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d8 [0126.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0126.721] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0126.824] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7d8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7d8, lpOverlapped=0x0) returned 1 [0126.825] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7e0, lpOverlapped=0x0) returned 1 [0126.826] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.853] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.865] CloseHandle (hObject=0x10c) returned 1 [0126.865] CloseHandle (hObject=0x110) returned 1 [0126.865] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256784D385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256784d385b315d.jpg")) returned 0 [0126.866] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424256784D385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424256784d385b315d.jpg")) returned 0x2020 [0126.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 0x325098 [0126.866] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 0 [0126.866] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0126.866] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 1 [0126.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 0xffffffff [0126.868] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 1 [0126.868] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0126.868] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.868] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0126.868] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0126.868] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b07c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0126.868] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0126.868] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b07c) returned 0x10ab [0126.869] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0126.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0126.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242427A39777A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242427a39777a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0126.870] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d7 [0126.870] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0126.870] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0126.961] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8d7, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x8d7, lpOverlapped=0x0) returned 1 [0126.964] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8e0, lpOverlapped=0x0) returned 1 [0126.965] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.988] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.000] CloseHandle (hObject=0x110) returned 1 [0127.000] CloseHandle (hObject=0x10c) returned 1 [0127.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242427A39777A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242427a39777a5b315d.jpg")) returned 0 [0127.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242427A39777A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242427a39777a5b315d.jpg")) returned 0x2020 [0127.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 0x325098 [0127.001] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 0 [0127.001] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0127.001] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 1 [0127.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 0xffffffff [0127.002] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 1 [0127.002] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0127.002] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.002] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0127.002] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0127.003] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b07c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0127.003] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.003] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b07c) returned 0x10ab [0127.003] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0127.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0127.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242427A7857315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242427a7857315b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0127.004] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24be [0127.004] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0127.004] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0127.105] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x24be, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x24be, lpOverlapped=0x0) returned 1 [0127.107] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x24c0, lpOverlapped=0x0) returned 1 [0127.108] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.131] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.142] CloseHandle (hObject=0x10c) returned 1 [0127.142] CloseHandle (hObject=0x110) returned 1 [0127.143] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242427A7857315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242427a7857315b315d.jpg")) returned 0 [0127.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242427A7857315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242427a7857315b315d.jpg")) returned 0x2020 [0127.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 0x325098 [0127.144] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 0 [0127.144] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0127.144] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 1 [0127.145] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 0xffffffff [0127.145] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1 [0127.145] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0127.145] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.145] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0127.145] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac5c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0127.145] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.145] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac5c) returned 0x10ab [0127.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0127.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243303655625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243303655625b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0127.147] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33a8 [0127.147] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0127.147] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0127.239] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x33a8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x33a8, lpOverlapped=0x0) returned 1 [0127.241] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x33b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x33b0, lpOverlapped=0x0) returned 1 [0127.242] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.265] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.276] CloseHandle (hObject=0x110) returned 1 [0127.276] CloseHandle (hObject=0x10c) returned 1 [0127.276] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243303655625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243303655625b315d.jpg")) returned 0 [0127.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243303655625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243303655625b315d.jpg")) returned 0x2020 [0127.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0x325098 [0127.277] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0 [0127.277] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0127.277] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 1 [0127.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 0xffffffff [0127.278] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 1 [0127.279] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0127.279] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.279] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0127.279] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0127.279] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af80, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0127.279] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.279] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af80) returned 0x10ab [0127.279] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0127.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0127.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243303935635B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243303935635b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0127.281] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x738 [0127.281] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0127.282] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0127.393] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x738, lpOverlapped=0x0) returned 1 [0127.395] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x740, lpOverlapped=0x0) returned 1 [0127.399] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.422] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.436] CloseHandle (hObject=0x10c) returned 1 [0127.436] CloseHandle (hObject=0x110) returned 1 [0127.438] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243303935635B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243303935635b315d.jpg")) returned 0 [0127.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243303935635B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243303935635b315d.jpg")) returned 0x2020 [0127.439] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 0x325098 [0127.439] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 0 [0127.439] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0127.439] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 1 [0127.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 0xffffffff [0127.441] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1 [0127.444] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0127.444] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0127.447] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0127.448] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0127.448] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.448] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0127.448] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0127.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0127.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424330414C435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424330414c435b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0127.450] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17a5 [0127.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0127.450] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0127.525] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x17a5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x17a5, lpOverlapped=0x0) returned 1 [0127.527] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x17b0, lpOverlapped=0x0) returned 1 [0127.528] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.551] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.562] CloseHandle (hObject=0x110) returned 1 [0127.562] CloseHandle (hObject=0x10c) returned 1 [0127.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424330414C435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424330414c435b315d.jpg")) returned 0 [0127.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424330414C435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424330414c435b315d.jpg")) returned 0x2020 [0127.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0x325098 [0127.563] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0 [0127.563] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0127.563] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 1 [0127.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 0xffffffff [0127.564] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 1 [0127.564] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0127.564] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.564] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0127.565] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0127.565] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0127.565] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.565] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0127.565] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0127.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0127.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243306C596E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243306c596e5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0127.567] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2720 [0127.567] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0127.567] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0127.664] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2720, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2720, lpOverlapped=0x0) returned 1 [0127.666] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2730, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2730, lpOverlapped=0x0) returned 1 [0127.667] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.690] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.701] CloseHandle (hObject=0x10c) returned 1 [0127.701] CloseHandle (hObject=0x110) returned 1 [0127.702] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243306C596E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243306c596e5b315d.jpg")) returned 0 [0127.702] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243306C596E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243306c596e5b315d.jpg")) returned 0x2020 [0127.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 0x325098 [0127.702] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 0 [0127.703] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0127.703] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 1 [0127.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 0xffffffff [0127.704] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 1 [0127.704] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0127.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0127.704] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0127.704] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0127.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0127.704] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0127.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0127.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243306D6C755B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243306d6c755b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0127.705] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x522 [0127.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0127.706] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0127.795] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x522, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x522, lpOverlapped=0x0) returned 1 [0127.796] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x530, lpOverlapped=0x0) returned 1 [0127.797] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.833] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.847] CloseHandle (hObject=0x110) returned 1 [0127.847] CloseHandle (hObject=0x10c) returned 1 [0127.848] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243306D6C755B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243306d6c755b315d.jpg")) returned 0 [0127.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243306D6C755B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243306d6c755b315d.jpg")) returned 0x2020 [0127.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 0x325098 [0127.849] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 0 [0127.849] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0127.849] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 1 [0127.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 0xffffffff [0127.850] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 1 [0127.851] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0127.851] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.851] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0127.851] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acf0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0127.851] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.851] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acf0) returned 0x10ab [0127.851] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0127.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307244615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307244615b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0127.852] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x188f [0127.852] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0127.853] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0127.943] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x188f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x188f, lpOverlapped=0x0) returned 1 [0127.949] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1890, lpOverlapped=0x0) returned 1 [0127.950] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.973] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.985] CloseHandle (hObject=0x10c) returned 1 [0127.985] CloseHandle (hObject=0x110) returned 1 [0127.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307244615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307244615b315d.jpg")) returned 0 [0127.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307244615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307244615b315d.jpg")) returned 0x2020 [0127.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 0x325098 [0127.986] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 0 [0127.986] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0127.986] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 1 [0127.987] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 0xffffffff [0127.987] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 1 [0127.988] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0127.988] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.988] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0127.988] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0127.988] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0127.988] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0127.988] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0127.988] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0127.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0127.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307244615B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307244615b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0127.989] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fe [0127.989] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0127.989] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0128.088] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7fe, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7fe, lpOverlapped=0x0) returned 1 [0128.090] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x800, lpOverlapped=0x0) returned 1 [0128.091] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.114] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.125] CloseHandle (hObject=0x110) returned 1 [0128.125] CloseHandle (hObject=0x10c) returned 1 [0128.125] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307244615B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307244615b325d.jpg")) returned 0 [0128.126] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307244615B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307244615b325d.jpg")) returned 0x2020 [0128.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 0x325098 [0128.126] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 0 [0128.126] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0128.126] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 1 [0128.127] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 0xffffffff [0128.127] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1 [0128.127] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0128.128] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.128] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0128.128] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0128.128] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0128.128] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.128] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0128.128] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0128.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0128.129] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307443695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307443695b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0128.130] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x320d [0128.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0128.130] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0128.220] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x320d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x320d, lpOverlapped=0x0) returned 1 [0128.222] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3210, lpOverlapped=0x0) returned 1 [0128.223] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.246] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.258] CloseHandle (hObject=0x10c) returned 1 [0128.258] CloseHandle (hObject=0x110) returned 1 [0128.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307443695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307443695b315d.jpg")) returned 0 [0128.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424243307443695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424243307443695b315d.jpg")) returned 0x2020 [0128.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0x325098 [0128.259] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0 [0128.259] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0128.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 1 [0128.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 0xffffffff [0128.260] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 1 [0128.260] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0128.260] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.260] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0128.260] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0128.261] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0128.261] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.261] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0ec) returned 0x10ab [0128.261] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0128.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0128.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242444B3759795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242444b3759795b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0128.268] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28f2 [0128.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0128.269] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0128.358] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x28f2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x28f2, lpOverlapped=0x0) returned 1 [0128.360] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2900, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2900, lpOverlapped=0x0) returned 1 [0128.361] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.398] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.409] CloseHandle (hObject=0x110) returned 1 [0128.409] CloseHandle (hObject=0x10c) returned 1 [0128.410] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242444B3759795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242444b3759795b315d.jpg")) returned 0 [0128.410] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242444B3759795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242444b3759795b315d.jpg")) returned 0x2020 [0128.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 0x325098 [0128.410] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 0 [0128.411] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0128.411] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 1 [0128.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 0xffffffff [0128.412] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 1 [0128.412] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0128.412] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.412] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0128.412] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0128.413] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b068, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0128.413] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.413] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b068) returned 0x10ab [0128.413] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0128.413] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0128.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424244526273485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424244526273485b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0128.415] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x83c [0128.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0128.415] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0128.489] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x83c, lpOverlapped=0x0) returned 1 [0128.491] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x840, lpOverlapped=0x0) returned 1 [0128.492] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.516] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.527] CloseHandle (hObject=0x10c) returned 1 [0128.527] CloseHandle (hObject=0x110) returned 1 [0128.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424244526273485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424244526273485b315d.jpg")) returned 0 [0128.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424244526273485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424244526273485b315d.jpg")) returned 0x2020 [0128.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 0x325098 [0128.528] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 0 [0128.528] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0128.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 1 [0128.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 0xffffffff [0128.529] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 1 [0128.529] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0128.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.529] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0128.529] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0128.530] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b068, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0128.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b068) returned 0x10ab [0128.530] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0128.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0128.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242445A6F5A525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242445a6f5a525b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0128.531] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x968 [0128.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0128.531] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0128.621] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x968, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x968, lpOverlapped=0x0) returned 1 [0128.622] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x970, lpOverlapped=0x0) returned 1 [0128.623] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.646] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.657] CloseHandle (hObject=0x110) returned 1 [0128.657] CloseHandle (hObject=0x10c) returned 1 [0128.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242445A6F5A525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242445a6f5a525b315d.jpg")) returned 0 [0128.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242445A6F5A525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242445a6f5a525b315d.jpg")) returned 0x2020 [0128.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 0x325098 [0128.658] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 0 [0128.658] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0128.658] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 1 [0128.659] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 0xffffffff [0128.659] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 1 [0128.659] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0128.659] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.659] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0128.659] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acf0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0128.659] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.659] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acf0) returned 0x10ab [0128.660] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0128.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424539374F385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424539374f385b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0128.667] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d4 [0128.667] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0128.667] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0128.756] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8d4, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x8d4, lpOverlapped=0x0) returned 1 [0128.758] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8e0, lpOverlapped=0x0) returned 1 [0128.759] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.781] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.792] CloseHandle (hObject=0x10c) returned 1 [0128.792] CloseHandle (hObject=0x110) returned 1 [0128.793] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424539374F385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424539374f385b315d.jpg")) returned 0 [0128.793] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424539374F385B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424539374f385b315d.jpg")) returned 0x2020 [0128.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 0x325098 [0128.793] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 0 [0128.794] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0128.794] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 1 [0128.795] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 0xffffffff [0128.795] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 1 [0128.795] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0128.795] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.795] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0128.795] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0128.795] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0128.795] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.795] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0128.796] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0128.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0128.797] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245397753745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245397753745b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0128.797] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e0 [0128.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0128.798] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0128.871] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6e0, lpOverlapped=0x0) returned 1 [0128.872] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6f0, lpOverlapped=0x0) returned 1 [0128.873] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.896] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.907] CloseHandle (hObject=0x110) returned 1 [0128.907] CloseHandle (hObject=0x10c) returned 1 [0128.907] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245397753745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245397753745b315d.jpg")) returned 0 [0128.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245397753745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245397753745b315d.jpg")) returned 0x2020 [0128.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 0x325098 [0128.908] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 0 [0128.908] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0128.908] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 1 [0128.909] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 0xffffffff [0128.909] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 1 [0128.909] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0128.909] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.909] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0128.909] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0128.910] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0128.910] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0128.910] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0128.910] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0128.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0128.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424563486C655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424563486c655b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0128.912] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b9 [0128.912] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0128.912] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0129.006] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8b9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x8b9, lpOverlapped=0x0) returned 1 [0129.008] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8c0, lpOverlapped=0x0) returned 1 [0129.009] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.031] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.042] CloseHandle (hObject=0x10c) returned 1 [0129.042] CloseHandle (hObject=0x110) returned 1 [0129.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424563486C655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424563486c655b315d.jpg")) returned 0 [0129.043] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424563486C655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424563486c655b315d.jpg")) returned 0x2020 [0129.043] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 0x325098 [0129.043] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 0 [0129.043] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0129.044] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 1 [0129.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 0xffffffff [0129.044] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 1 [0129.045] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0129.045] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.045] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0129.045] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0129.045] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0129.045] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.045] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0129.045] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0129.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0129.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245644530665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245644530665b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0129.056] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2086 [0129.056] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0129.056] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0129.151] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2086, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2086, lpOverlapped=0x0) returned 1 [0129.153] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2090, lpOverlapped=0x0) returned 1 [0129.154] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.177] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.188] CloseHandle (hObject=0x110) returned 1 [0129.188] CloseHandle (hObject=0x10c) returned 1 [0129.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245644530665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245644530665b315d.jpg")) returned 0 [0129.189] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245644530665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245644530665b315d.jpg")) returned 0x2020 [0129.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 0x325098 [0129.189] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 0 [0129.189] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0129.189] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 1 [0129.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 0xffffffff [0129.190] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 1 [0129.191] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0129.191] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.191] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0129.191] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abd0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0129.191] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.191] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abd0) returned 0x10ab [0129.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0129.193] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245646F51765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245646f51765b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0129.193] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97b [0129.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0129.194] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0129.282] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x97b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x97b, lpOverlapped=0x0) returned 1 [0129.286] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x980, lpOverlapped=0x0) returned 1 [0129.287] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.309] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.321] CloseHandle (hObject=0x10c) returned 1 [0129.321] CloseHandle (hObject=0x110) returned 1 [0129.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245646F51765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245646f51765b315d.jpg")) returned 0 [0129.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245646F51765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245646f51765b315d.jpg")) returned 0x2020 [0129.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 0x325098 [0129.322] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 0 [0129.322] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0129.322] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 1 [0129.323] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 0xffffffff [0129.323] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 1 [0129.323] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0129.323] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.323] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0129.323] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0129.324] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2affc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0129.324] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.324] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2affc) returned 0x10ab [0129.324] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0129.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0129.325] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245647145795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245647145795b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0129.325] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69a [0129.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0129.326] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0129.407] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x69a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x69a, lpOverlapped=0x0) returned 1 [0129.409] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6a0, lpOverlapped=0x0) returned 1 [0129.410] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.432] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.444] CloseHandle (hObject=0x110) returned 1 [0129.444] CloseHandle (hObject=0x10c) returned 1 [0129.444] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245647145795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245647145795b315d.jpg")) returned 0 [0129.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245647145795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245647145795b315d.jpg")) returned 0x2020 [0129.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 0x325098 [0129.445] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 0 [0129.445] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0129.445] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 1 [0129.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 0xffffffff [0129.446] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 1 [0129.446] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0129.446] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.446] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0129.446] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0129.447] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b104, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0129.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b104) returned 0x10ab [0129.447] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0129.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0129.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245647457775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245647457775b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0129.449] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6d0 [0129.449] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0129.449] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0129.552] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6d0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6d0, lpOverlapped=0x0) returned 1 [0129.555] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6e0, lpOverlapped=0x0) returned 1 [0129.556] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.580] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.619] CloseHandle (hObject=0x10c) returned 1 [0129.619] CloseHandle (hObject=0x110) returned 1 [0129.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245647457775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245647457775b315d.jpg")) returned 0 [0129.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245647457775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245647457775b315d.jpg")) returned 0x2020 [0129.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 0x325098 [0129.620] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 0 [0129.620] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0129.620] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 1 [0129.621] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 0xffffffff [0129.621] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 1 [0129.622] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0129.622] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.622] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0129.622] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0129.622] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0129.622] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.622] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b088) returned 0x10ab [0129.622] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0129.623] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0129.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424564584A6A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424564584a6a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0129.627] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x687 [0129.628] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0129.628] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0129.702] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x687, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x687, lpOverlapped=0x0) returned 1 [0129.703] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x690, lpOverlapped=0x0) returned 1 [0129.704] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.727] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.738] CloseHandle (hObject=0x110) returned 1 [0129.738] CloseHandle (hObject=0x10c) returned 1 [0129.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424564584A6A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424564584a6a5b315d.jpg")) returned 0 [0129.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424564584A6A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424564584a6a5b315d.jpg")) returned 0x2020 [0129.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 0x325098 [0129.740] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 0 [0129.740] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0129.740] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 1 [0129.741] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 0xffffffff [0129.741] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 1 [0129.741] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0129.741] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.741] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0129.741] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0129.742] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0129.742] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.742] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b088) returned 0x10ab [0129.742] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0129.742] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0129.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456550306B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456550306b5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0129.743] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24c8 [0129.743] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0129.744] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0129.835] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x24c8, lpOverlapped=0x0) returned 1 [0129.837] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x24d0, lpOverlapped=0x0) returned 1 [0129.838] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.860] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.871] CloseHandle (hObject=0x10c) returned 1 [0129.871] CloseHandle (hObject=0x110) returned 1 [0129.871] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456550306B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456550306b5b315d.jpg")) returned 0 [0129.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456550306B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456550306b5b315d.jpg")) returned 0x2020 [0129.872] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 0x325098 [0129.872] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 0 [0129.872] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0129.872] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 1 [0129.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 0xffffffff [0129.873] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1 [0129.874] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0129.874] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.874] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0129.874] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acf8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0129.874] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0129.874] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acf8) returned 0x10ab [0129.874] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0129.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245655475665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245655475665b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0129.875] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3417 [0129.875] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0129.876] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0129.977] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3417, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3417, lpOverlapped=0x0) returned 1 [0129.981] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3420, lpOverlapped=0x0) returned 1 [0129.983] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.009] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.021] CloseHandle (hObject=0x110) returned 1 [0130.021] CloseHandle (hObject=0x10c) returned 1 [0130.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245655475665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245655475665b315d.jpg")) returned 0 [0130.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245655475665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245655475665b315d.jpg")) returned 0x2020 [0130.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0x325098 [0130.023] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0 [0130.023] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0130.023] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 1 [0130.024] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 0xffffffff [0130.024] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 1 [0130.025] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0130.025] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.025] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0130.025] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0130.025] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b030, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0130.025] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.025] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b030) returned 0x10ab [0130.025] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0130.026] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0130.028] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245664536655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245664536655b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0130.029] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0b [0130.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0130.029] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0130.131] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc0b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xc0b, lpOverlapped=0x0) returned 1 [0130.132] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xc10, lpOverlapped=0x0) returned 1 [0130.133] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.156] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.167] CloseHandle (hObject=0x10c) returned 1 [0130.167] CloseHandle (hObject=0x110) returned 1 [0130.167] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245664536655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245664536655b315d.jpg")) returned 0 [0130.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245664536655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245664536655b315d.jpg")) returned 0x2020 [0130.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 0x325098 [0130.168] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 0 [0130.168] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0130.168] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 1 [0130.169] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 0xffffffff [0130.169] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1 [0130.171] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0130.171] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.171] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0130.171] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0130.172] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b030, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0130.172] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.172] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b030) returned 0x10ab [0130.172] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0130.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0130.173] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245666A75545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245666a75545b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0130.173] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c4c [0130.174] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0130.174] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0130.248] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3c4c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3c4c, lpOverlapped=0x0) returned 1 [0130.250] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3c50, lpOverlapped=0x0) returned 1 [0130.251] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.274] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.285] CloseHandle (hObject=0x110) returned 1 [0130.285] CloseHandle (hObject=0x10c) returned 1 [0130.285] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245666A75545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245666a75545b315d.jpg")) returned 0 [0130.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245666A75545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245666a75545b315d.jpg")) returned 0x2020 [0130.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0x325098 [0130.286] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0 [0130.286] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0130.286] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 1 [0130.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 0xffffffff [0130.287] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 1 [0130.288] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0130.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0130.288] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac64, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0130.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac64) returned 0x10ab [0130.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0130.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245673951565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245673951565b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0130.289] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0e [0130.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0130.290] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0130.395] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f0e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1f0e, lpOverlapped=0x0) returned 1 [0130.397] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1f10, lpOverlapped=0x0) returned 1 [0130.398] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.420] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.431] CloseHandle (hObject=0x10c) returned 1 [0130.432] CloseHandle (hObject=0x110) returned 1 [0130.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245673951565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245673951565b315d.jpg")) returned 0 [0130.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245673951565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245673951565b315d.jpg")) returned 0x2020 [0130.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 0x325098 [0130.432] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 0 [0130.433] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0130.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 1 [0130.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 0xffffffff [0130.434] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 1 [0130.434] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0130.434] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.434] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0130.434] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0130.434] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afa4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0130.434] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.434] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afa4) returned 0x10ab [0130.434] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0130.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0130.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456747536C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456747536c5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0130.436] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x980 [0130.436] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0130.436] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0130.515] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x980, lpOverlapped=0x0) returned 1 [0130.519] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x990, lpOverlapped=0x0) returned 1 [0130.520] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.542] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.553] CloseHandle (hObject=0x110) returned 1 [0130.553] CloseHandle (hObject=0x10c) returned 1 [0130.554] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456747536C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456747536c5b315d.jpg")) returned 0 [0130.554] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456747536C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456747536c5b315d.jpg")) returned 0x2020 [0130.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 0x325098 [0130.554] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 0 [0130.554] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0130.554] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 1 [0130.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 0xffffffff [0130.555] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1 [0130.556] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0130.556] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.556] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0130.556] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0130.556] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b024, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0130.556] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.556] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b024) returned 0x10ab [0130.556] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0130.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0130.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245676959775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245676959775b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0130.558] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23fd [0130.558] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0130.558] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0130.661] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x23fd, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x23fd, lpOverlapped=0x0) returned 1 [0130.663] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2400, lpOverlapped=0x0) returned 1 [0130.664] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.687] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.698] CloseHandle (hObject=0x10c) returned 1 [0130.698] CloseHandle (hObject=0x110) returned 1 [0130.698] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245676959775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245676959775b315d.jpg")) returned 0 [0130.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245676959775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245676959775b315d.jpg")) returned 0x2020 [0130.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0x325098 [0130.699] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0 [0130.699] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0130.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 1 [0130.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 0xffffffff [0130.701] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1 [0130.701] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0130.701] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.701] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0130.701] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0130.701] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0130.701] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.702] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0130.702] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0130.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0130.703] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245674A667A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245674a667a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0130.703] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a59 [0130.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0130.703] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0130.792] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a59, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1a59, lpOverlapped=0x0) returned 1 [0130.794] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1a60, lpOverlapped=0x0) returned 1 [0130.795] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.818] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.829] CloseHandle (hObject=0x110) returned 1 [0130.829] CloseHandle (hObject=0x10c) returned 1 [0130.829] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245674A667A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245674a667a5b315d.jpg")) returned 0 [0130.830] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245674A667A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245674a667a5b315d.jpg")) returned 0x2020 [0130.830] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0x325098 [0130.830] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0 [0130.830] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0130.830] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 1 [0130.831] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 0xffffffff [0130.831] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 1 [0130.832] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0130.832] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.832] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0130.832] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0130.832] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afa4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0130.832] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.832] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afa4) returned 0x10ab [0130.832] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0130.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0130.833] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677174595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677174595b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0130.834] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b0 [0130.834] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0130.834] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0130.924] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7b0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7b0, lpOverlapped=0x0) returned 1 [0130.926] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7c0, lpOverlapped=0x0) returned 1 [0130.926] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.949] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.960] CloseHandle (hObject=0x10c) returned 1 [0130.960] CloseHandle (hObject=0x110) returned 1 [0130.961] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677174595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677174595b315d.jpg")) returned 0 [0130.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677174595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677174595b315d.jpg")) returned 0x2020 [0130.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 0x325098 [0130.961] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 0 [0130.961] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0130.962] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 1 [0130.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 0xffffffff [0130.963] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1 [0130.963] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0130.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0130.963] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0130.963] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0130.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0130.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0130.963] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0130.964] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0130.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424567737A335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424567737a335b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0130.965] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44ec [0130.965] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0130.966] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0131.041] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x44ec, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x44ec, lpOverlapped=0x0) returned 1 [0131.056] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x44f0, lpOverlapped=0x0) returned 1 [0131.057] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.080] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.091] CloseHandle (hObject=0x110) returned 1 [0131.091] CloseHandle (hObject=0x10c) returned 1 [0131.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424567737A335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424567737a335b315d.jpg")) returned 0 [0131.092] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42424567737A335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42424567737a335b315d.jpg")) returned 0x2020 [0131.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0x325098 [0131.092] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0 [0131.092] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0131.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 1 [0131.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 0xffffffff [0131.093] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 1 [0131.094] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0131.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0131.094] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0131.094] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b100, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0131.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b100) returned 0x10ab [0131.094] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0131.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0131.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677463535B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677463535b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0131.105] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171b [0131.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0131.106] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0131.195] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x171b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x171b, lpOverlapped=0x0) returned 1 [0131.239] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1720, lpOverlapped=0x0) returned 1 [0131.240] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.262] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.273] CloseHandle (hObject=0x10c) returned 1 [0131.273] CloseHandle (hObject=0x110) returned 1 [0131.274] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677463535B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677463535b315d.jpg")) returned 0 [0131.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677463535B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677463535b315d.jpg")) returned 0x2020 [0131.274] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 0x325098 [0131.274] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 0 [0131.274] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0131.274] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 1 [0131.275] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 0xffffffff [0131.275] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 1 [0131.276] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0131.276] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.276] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0131.276] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0131.276] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0131.276] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.276] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0131.276] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0131.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0131.278] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677463535B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677463535b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0131.278] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1826 [0131.278] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0131.279] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0131.384] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1826, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1826, lpOverlapped=0x0) returned 1 [0131.403] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1830, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1830, lpOverlapped=0x0) returned 1 [0131.404] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.426] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.437] CloseHandle (hObject=0x110) returned 1 [0131.437] CloseHandle (hObject=0x10c) returned 1 [0131.437] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677463535B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677463535b325d.jpg")) returned 0 [0131.438] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677463535B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677463535b325d.jpg")) returned 0x2020 [0131.438] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 0x325098 [0131.439] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 0 [0131.439] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0131.439] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 1 [0131.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 0xffffffff [0131.440] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1 [0131.440] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0131.440] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.440] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0131.440] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0131.440] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.440] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e8) returned 0x10ab [0131.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0131.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677835665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677835665b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0131.442] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e5 [0131.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0131.442] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0131.518] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5e5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x5e5, lpOverlapped=0x0) returned 1 [0131.529] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5f0, lpOverlapped=0x0) returned 1 [0131.555] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.587] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.605] CloseHandle (hObject=0x10c) returned 1 [0131.605] CloseHandle (hObject=0x110) returned 1 [0131.608] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677835665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677835665b315d.jpg")) returned 0 [0131.634] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677835665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677835665b315d.jpg")) returned 0x2020 [0131.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0x325098 [0131.634] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0 [0131.634] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0131.634] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 1 [0131.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 0xffffffff [0131.635] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 1 [0131.648] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0131.648] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.653] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0131.653] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0131.653] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.653] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad28) returned 0x10ab [0131.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0131.654] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677835665B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677835665b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0131.655] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e5 [0131.655] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0131.655] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0131.756] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5e5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x5e5, lpOverlapped=0x0) returned 1 [0131.785] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5f0, lpOverlapped=0x0) returned 1 [0131.786] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.809] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.820] CloseHandle (hObject=0x110) returned 1 [0131.820] CloseHandle (hObject=0x10c) returned 1 [0131.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677835665B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677835665b325d.jpg")) returned 0 [0131.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424245677835665B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424245677835665b325d.jpg")) returned 0x2020 [0131.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 0x325098 [0131.821] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 0 [0131.821] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0131.821] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 1 [0131.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 0xffffffff [0131.822] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 1 [0131.822] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0131.822] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.822] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0131.822] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0131.823] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0131.823] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.823] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0131.823] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0131.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0131.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456779496D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456779496d5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0131.824] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3565 [0131.824] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0131.824] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0131.858] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3565, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3565, lpOverlapped=0x0) returned 1 [0131.860] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3570, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3570, lpOverlapped=0x0) returned 1 [0131.861] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.884] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.895] CloseHandle (hObject=0x10c) returned 1 [0131.895] CloseHandle (hObject=0x110) returned 1 [0131.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456779496D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456779496d5b315d.jpg")) returned 0 [0131.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242456779496D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242456779496d5b315d.jpg")) returned 0x2020 [0131.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 0x325098 [0131.896] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 0 [0131.896] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0131.896] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 1 [0131.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 0xffffffff [0131.897] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 1 [0131.898] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0131.898] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.898] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0131.898] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0131.898] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b074, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0131.898] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0131.898] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b074) returned 0x10ab [0131.898] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0131.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0131.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424267334F44585B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424267334f44585b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0131.902] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3 [0131.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0131.903] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0131.973] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xf3, lpOverlapped=0x0) returned 1 [0131.975] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x100, lpOverlapped=0x0) returned 1 [0131.975] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.998] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.009] CloseHandle (hObject=0x110) returned 1 [0132.009] CloseHandle (hObject=0x10c) returned 1 [0132.009] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424267334F44585B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424267334f44585b325d.png")) returned 0 [0132.010] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\424267334F44585B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\424267334f44585b325d.png")) returned 0x2020 [0132.010] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 0x325098 [0132.010] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 0 [0132.010] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0132.010] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 1 [0132.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 0xffffffff [0132.011] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 1 [0132.012] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.012] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.012] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.012] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0132.012] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.012] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.012] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0e4) returned 0x10ab [0132.012] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0132.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0132.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242697943715B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242697943715b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.013] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b9 [0132.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0132.014] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0132.110] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3b9, lpOverlapped=0x0) returned 1 [0132.121] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3c0, lpOverlapped=0x0) returned 1 [0132.122] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.145] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.156] CloseHandle (hObject=0x10c) returned 1 [0132.156] CloseHandle (hObject=0x110) returned 1 [0132.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242697943715B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242697943715b315d.png")) returned 0 [0132.157] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\4242697943715B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\4242697943715b315d.png")) returned 0x2020 [0132.157] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 0x325098 [0132.158] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 0 [0132.158] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0132.158] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 1 [0132.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 0xffffffff [0132.159] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 1 [0132.159] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.159] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.159] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.159] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.159] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.159] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9b8) returned 0x10ab [0132.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42426E346C55555B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42426e346c55555b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0132.160] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d [0132.160] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0132.161] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0132.250] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x14d, lpOverlapped=0x0) returned 1 [0132.251] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x150, lpOverlapped=0x0) returned 1 [0132.252] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.275] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.286] CloseHandle (hObject=0x110) returned 1 [0132.286] CloseHandle (hObject=0x10c) returned 1 [0132.286] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42426E346C55555B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42426e346c55555b315d.png")) returned 0 [0132.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42426E346C55555B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42426e346c55555b315d.png")) returned 0x2020 [0132.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 0x325098 [0132.287] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 0 [0132.287] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0132.287] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 1 [0132.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 0xffffffff [0132.288] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 1 [0132.289] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.289] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adfc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adfc) returned 0x10ab [0132.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0132.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42426E4D4B654E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42426e4d4b654e5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.290] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24b [0132.290] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0132.290] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0132.364] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x24b, lpOverlapped=0x0) returned 1 [0132.366] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x250, lpOverlapped=0x0) returned 1 [0132.366] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.389] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.426] CloseHandle (hObject=0x10c) returned 1 [0132.426] CloseHandle (hObject=0x110) returned 1 [0132.426] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42426E4D4B654E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42426e4d4b654e5b315d.png")) returned 0 [0132.427] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42426E4D4B654E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42426e4d4b654e5b315d.png")) returned 0x2020 [0132.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 0x325098 [0132.427] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 0 [0132.427] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0132.427] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 1 [0132.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 0xffffffff [0132.428] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 1 [0132.428] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.428] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.428] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.428] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0132.429] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.429] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.429] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0132.429] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0132.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.432] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42427747616E395B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42427747616e395b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0132.433] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38b7 [0132.433] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0132.433] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0132.506] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x38b7, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x38b7, lpOverlapped=0x0) returned 1 [0132.514] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x38c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x38c0, lpOverlapped=0x0) returned 1 [0132.515] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.538] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.549] CloseHandle (hObject=0x110) returned 1 [0132.549] CloseHandle (hObject=0x10c) returned 1 [0132.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42427747616E395B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42427747616e395b315d.jpg")) returned 0 [0132.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42427747616E395B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42427747616e395b315d.jpg")) returned 0x2020 [0132.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 0x325098 [0132.550] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 0 [0132.550] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0132.550] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 1 [0132.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 0xffffffff [0132.552] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 1 [0132.552] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.552] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.552] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.552] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0132.552] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.552] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.552] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0132.553] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0132.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0132.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42427A3365626B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42427a3365626b5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.554] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36c [0132.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0132.554] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0132.646] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x36c, lpOverlapped=0x0) returned 1 [0132.648] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x370, lpOverlapped=0x0) returned 1 [0132.649] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.671] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.682] CloseHandle (hObject=0x10c) returned 1 [0132.682] CloseHandle (hObject=0x110) returned 1 [0132.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42427A3365626B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42427a3365626b5b315d.png")) returned 0 [0132.683] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\42427A3365626B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\42427a3365626b5b315d.png")) returned 0x2020 [0132.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 0x325098 [0132.683] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 0 [0132.684] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0132.684] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 1 [0132.685] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 0xffffffff [0132.685] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 1 [0132.685] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.685] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.685] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.685] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0132.685] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b100, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.685] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.685] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b100) returned 0x10ab [0132.686] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0132.686] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.687] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\62656E65666974732D352D6D6F62696C655B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\62656e65666974732d352d6d6f62696c655b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0132.688] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29ed [0132.688] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0132.688] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0132.777] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29ed, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x29ed, lpOverlapped=0x0) returned 1 [0132.785] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x29f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x29f0, lpOverlapped=0x0) returned 1 [0132.786] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.809] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.820] CloseHandle (hObject=0x110) returned 1 [0132.820] CloseHandle (hObject=0x10c) returned 1 [0132.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\62656E65666974732D352D6D6F62696C655B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\62656e65666974732d352d6d6f62696c655b315d.png")) returned 0 [0132.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\62656E65666974732D352D6D6F62696C655B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\62656e65666974732d352d6d6f62696c655b315d.png")) returned 0x2020 [0132.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 0x325098 [0132.821] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 0 [0132.821] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0132.821] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 1 [0132.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 0xffffffff [0132.822] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61804060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61804060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61850320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f3f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0132.824] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.824] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.824] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.824] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0132.825] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.825] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.825] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0132.825] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0132.825] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 1 [0132.825] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.825] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.825] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.825] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.825] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.825] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa10) returned 0x10ab [0132.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0132.827] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6368726F6D652D6E65775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6368726f6d652d6e65775b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.827] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c6c [0132.827] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0132.828] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0132.924] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10c6c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x10c6c, lpOverlapped=0x0) returned 1 [0132.938] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10c70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x10c70, lpOverlapped=0x0) returned 1 [0132.941] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.963] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.975] CloseHandle (hObject=0x10c) returned 1 [0132.975] CloseHandle (hObject=0x110) returned 1 [0132.975] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6368726F6D652D6E65775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6368726f6d652d6e65775b315d.jpg")) returned 0 [0132.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6368726F6D652D6E65775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6368726f6d652d6e65775b315d.jpg")) returned 0x2020 [0132.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 0x325098 [0132.976] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 0 [0132.976] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0132.976] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 1 [0132.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 0xffffffff [0132.977] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60b128c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4739, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", cAlternateFileName="CJZKEO~1.EOT")) returned 1 [0132.978] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.978] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.978] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.978] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.978] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.978] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af50) returned 0x10ab [0132.978] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0132.978] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0132.978] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.978] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0132.978] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0132.978] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0132.979] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0132.979] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0132.979] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0132.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\436F6E7461696E65725461675B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\436f6e7461696e65725461675b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0132.981] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b1 [0132.981] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0132.981] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0133.056] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7b1, lpOverlapped=0x0) returned 1 [0133.059] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7c0, lpOverlapped=0x0) returned 1 [0133.060] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.082] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.094] CloseHandle (hObject=0x110) returned 1 [0133.095] CloseHandle (hObject=0x10c) returned 1 [0133.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\436F6E7461696E65725461675B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\436f6e7461696e65725461675b315d.js")) returned 0 [0133.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\436F6E7461696E65725461675B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\436f6e7461696e65725461675b315d.js")) returned 0x2020 [0133.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 0x325098 [0133.096] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 0 [0133.096] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0133.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js")) returned 1 [0133.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js")) returned 0xffffffff [0133.097] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 1 [0133.097] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.097] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.097] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.097] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.097] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0133.098] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0133.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\436F6E7461696E65725461675B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\436f6e7461696e65725461675b325d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.099] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b1 [0133.099] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0133.099] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0133.197] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7b1, lpOverlapped=0x0) returned 1 [0133.199] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7c0, lpOverlapped=0x0) returned 1 [0133.200] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.222] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.234] CloseHandle (hObject=0x10c) returned 1 [0133.234] CloseHandle (hObject=0x110) returned 1 [0133.234] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\436F6E7461696E65725461675B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\436f6e7461696e65725461675b325d.js")) returned 0 [0133.235] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\436F6E7461696E65725461675B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\436f6e7461696e65725461675b325d.js")) returned 0x2020 [0133.235] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 0x325098 [0133.235] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 0 [0133.235] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0133.235] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js")) returned 1 [0133.236] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js")) returned 0xffffffff [0133.236] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 1 [0133.236] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.236] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.236] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.236] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.237] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.237] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.237] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0fc) returned 0x10ab [0133.237] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.237] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.238] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6373735B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6373735b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0133.238] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0133.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0133.239] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0133.328] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xbb, lpOverlapped=0x0) returned 1 [0133.329] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xc0, lpOverlapped=0x0) returned 1 [0133.330] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.353] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.364] CloseHandle (hObject=0x110) returned 1 [0133.364] CloseHandle (hObject=0x10c) returned 1 [0133.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6373735B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6373735b325d.txt")) returned 0 [0133.365] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6373735B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6373735b325d.txt")) returned 0x2020 [0133.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 0x325098 [0133.365] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 0 [0133.365] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0133.365] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 1 [0133.366] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 0xffffffff [0133.366] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0133.366] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.366] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.366] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.366] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.367] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.367] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.367] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b088) returned 0x10ab [0133.367] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.367] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0133.367] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.368] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0133.368] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0133.368] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0133.464] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x43, lpOverlapped=0x0) returned 1 [0133.465] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x50, lpOverlapped=0x0) returned 1 [0133.466] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.489] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.500] CloseHandle (hObject=0x10c) returned 1 [0133.500] CloseHandle (hObject=0x110) returned 1 [0133.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6465736b746f70.ini")) returned 0 [0133.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6465736b746f70.ini")) returned 0x2020 [0133.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325098 [0133.501] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0133.501] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0133.501] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 1 [0133.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 0xffffffff [0133.502] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5114bad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5114bad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x511bdef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39a21, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="f8-028d9f-f30905ea[1]", cAlternateFileName="F8-028~1")) returned 1 [0133.503] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.503] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.503] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.503] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.503] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b088) returned 0x10ab [0133.503] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.504] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 1 [0133.504] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.504] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.504] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.504] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.504] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.504] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.504] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b088) returned 0x10ab [0133.504] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.504] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\66616C6C6261636B5F3732387839305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\66616c6c6261636b5f3732387839305b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0133.512] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f78 [0133.512] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0133.513] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0133.636] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7f78, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7f78, lpOverlapped=0x0) returned 1 [0133.638] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7f80, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7f80, lpOverlapped=0x0) returned 1 [0133.640] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.662] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.674] CloseHandle (hObject=0x110) returned 1 [0133.674] CloseHandle (hObject=0x10c) returned 1 [0133.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\66616C6C6261636B5F3732387839305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\66616c6c6261636b5f3732387839305b315d.jpg")) returned 0 [0133.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\66616C6C6261636B5F3732387839305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\66616c6c6261636b5f3732387839305b315d.jpg")) returned 0x2020 [0133.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 0x325098 [0133.675] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 0 [0133.675] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0133.675] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 1 [0133.676] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 0xffffffff [0133.676] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0133.677] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.677] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.677] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.677] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.677] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b08c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.678] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.678] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b08c) returned 0x10ab [0133.678] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.678] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde189b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde189b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde189b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0133.678] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.678] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.678] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.678] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aecc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.678] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.678] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aecc) returned 0x10ab [0133.678] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 1 [0133.678] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.678] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.679] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.679] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.679] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af98, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.679] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.679] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af98) returned 0x10ab [0133.679] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.679] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0133.679] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6965385B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6965385b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.680] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0133.680] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0133.680] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0133.769] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x66, lpOverlapped=0x0) returned 1 [0133.771] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x70, lpOverlapped=0x0) returned 1 [0133.772] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.795] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.806] CloseHandle (hObject=0x10c) returned 1 [0133.806] CloseHandle (hObject=0x110) returned 1 [0133.806] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6965385B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6965385b315d.txt")) returned 0 [0133.806] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6965385B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6965385b315d.txt")) returned 0x2020 [0133.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 0x325098 [0133.807] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 0 [0133.807] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0133.807] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 1 [0133.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 0xffffffff [0133.808] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bff750, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bff750, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bff750, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0133.808] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.808] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.808] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.808] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.808] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.808] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.808] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0133.809] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.809] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x88e7, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0133.809] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.809] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.809] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.810] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.810] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.810] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.810] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0133.810] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.810] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1180, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="meversion[1]", cAlternateFileName="MEVERS~1")) returned 1 [0133.810] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.810] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.810] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.810] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.811] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.811] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.811] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0133.811] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.811] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0133.811] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.811] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.811] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.811] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.811] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.811] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.812] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0133.812] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.812] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.813] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6F6E6C795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6f6e6c795b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0133.813] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0133.813] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0133.813] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0133.923] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6F6E6C795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6f6e6c795b315d.htm")) returned 0 [0133.924] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\6F6E6C795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\6f6e6c795b315d.htm")) returned 0x2020 [0133.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 0x325098 [0133.924] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 0 [0133.924] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0133.924] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm")) returned 1 [0133.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm")) returned 0xffffffff [0133.925] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 1 [0133.925] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0133.925] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.925] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0133.925] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0133.926] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0133.926] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0133.926] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0133.926] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0133.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\50617373706F72745B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\50617373706f72745b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.927] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140 [0133.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0133.928] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0134.021] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x140, lpOverlapped=0x0) returned 1 [0134.024] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x150, lpOverlapped=0x0) returned 1 [0134.025] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.048] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.060] CloseHandle (hObject=0x10c) returned 1 [0134.060] CloseHandle (hObject=0x110) returned 1 [0134.060] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\50617373706F72745B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\50617373706f72745b315d.htm")) returned 0 [0134.061] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\50617373706F72745B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\50617373706f72745b315d.htm")) returned 0x2020 [0134.061] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 0x325098 [0134.061] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 0 [0134.061] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0134.061] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm")) returned 1 [0134.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm")) returned 0xffffffff [0134.063] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 1 [0134.063] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0134.063] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.063] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0134.063] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0134.063] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0134.063] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.064] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0134.064] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.065] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\706C75736F6E655B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\706c75736f6e655b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0134.065] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f32 [0134.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0134.066] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0134.166] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9f32, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9f32, lpOverlapped=0x0) returned 1 [0134.169] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9f40, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9f40, lpOverlapped=0x0) returned 1 [0134.174] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.197] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.208] CloseHandle (hObject=0x110) returned 1 [0134.208] CloseHandle (hObject=0x10c) returned 1 [0134.209] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\706C75736F6E655B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\706c75736f6e655b315d.js")) returned 0 [0134.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\706C75736F6E655B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\706c75736f6e655b315d.js")) returned 0x2020 [0134.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 0x325098 [0134.209] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 0 [0134.209] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0134.210] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js")) returned 1 [0134.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js")) returned 0xffffffff [0134.211] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 1 [0134.211] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0134.211] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0134.211] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0134.211] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad7c) returned 0x10ab [0134.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0134.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\706F73746D65737361676552656C61795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\706f73746d65737361676552656c61795b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.213] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fa [0134.213] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0134.213] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0134.303] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1fa, lpOverlapped=0x0) returned 1 [0134.304] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x200, lpOverlapped=0x0) returned 1 [0134.305] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.327] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.338] CloseHandle (hObject=0x10c) returned 1 [0134.338] CloseHandle (hObject=0x110) returned 1 [0134.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\706F73746D65737361676552656C61795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\706f73746d65737361676552656c61795b315d.htm")) returned 0 [0134.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\706F73746D65737361676552656C61795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\706f73746d65737361676552656c61795b315d.htm")) returned 0x2020 [0134.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 0x325098 [0134.340] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 0 [0134.340] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0134.340] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm")) returned 1 [0134.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm")) returned 0xffffffff [0134.341] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 1 [0134.341] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0134.341] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.341] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0134.341] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0134.342] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0134.342] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.342] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0134.342] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\7365617263685B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\7365617263685b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0134.343] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a6f [0134.343] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0134.343] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0134.426] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19a6f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x19a6f, lpOverlapped=0x0) returned 1 [0134.430] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19a70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x19a70, lpOverlapped=0x0) returned 1 [0134.433] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.455] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.466] CloseHandle (hObject=0x110) returned 1 [0134.466] CloseHandle (hObject=0x10c) returned 1 [0134.466] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\7365617263685B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\7365617263685b315d.htm")) returned 0 [0134.467] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\7365617263685B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\7365617263685b315d.htm")) returned 0x2020 [0134.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 0x325098 [0134.467] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 0 [0134.467] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0134.467] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm")) returned 1 [0134.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm")) returned 0xffffffff [0134.469] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 1 [0134.469] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0134.469] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.469] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0134.469] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0134.470] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b098, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0134.470] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.470] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b098) returned 0x10ab [0134.470] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0134.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\7568662D776573742D6575726F7065616E2D64656661756C742E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\7568662d776573742d6575726f7065616e2d64656661756c742e6d696e5b315d.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.472] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c85b [0134.472] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0134.472] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0134.577] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c85b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c85b, lpOverlapped=0x0) returned 1 [0134.584] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c860, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1c860, lpOverlapped=0x0) returned 1 [0134.589] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.627] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.638] CloseHandle (hObject=0x10c) returned 1 [0134.638] CloseHandle (hObject=0x110) returned 1 [0134.639] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\7568662D776573742D6575726F7065616E2D64656661756C742E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\7568662d776573742d6575726f7065616e2d64656661756c742e6d696e5b315d.css")) returned 0 [0134.640] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\7568662D776573742D6575726F7065616E2D64656661756C742E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\7568662d776573742d6575726f7065616e2d64656661756c742e6d696e5b315d.css")) returned 0x2020 [0134.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 0x325098 [0134.640] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 0 [0134.640] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0134.640] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css")) returned 1 [0134.642] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css")) returned 0xffffffff [0134.642] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 1 [0134.643] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0134.643] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.643] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0134.643] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0134.644] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0134.644] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.644] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0134.644] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.644] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\576562436F72652E342E31392E302E6C74722E6C696768742E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\576562436f72652e342e31392e302e6c74722e6c696768742e6d696e5b315d.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0134.645] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1687 [0134.645] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0134.646] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0134.723] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1687, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1687, lpOverlapped=0x0) returned 1 [0134.725] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1690, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1690, lpOverlapped=0x0) returned 1 [0134.726] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.749] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.760] CloseHandle (hObject=0x110) returned 1 [0134.760] CloseHandle (hObject=0x10c) returned 1 [0134.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\576562436F72652E342E31392E302E6C74722E6C696768742E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\576562436f72652e342e31392e302e6c74722e6c696768742e6d696e5b315d.css")) returned 0 [0134.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\576562436F72652E342E31392E302E6C74722E6C696768742E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\576562436f72652e342e31392e302e6c74722e6c696768742e6d696e5b315d.css")) returned 0x2020 [0134.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0x325098 [0134.761] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0 [0134.761] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0134.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css")) returned 1 [0134.762] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css")) returned 0xffffffff [0134.762] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0 [0134.762] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0134.762] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e302e39, dwReserved1=0x2e72746c, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1 [0134.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName=".", cAlternateFileName="")) returned 0x325058 [0134.765] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="..", cAlternateFileName="")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 1 [0134.766] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0134.766] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.766] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0134.766] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0134.766] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0134.766] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.766] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0134.767] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0134.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\3030303030303932393039365B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\3030303030303932393039365b315d.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.768] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe455 [0134.768] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0134.768] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0134.857] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe455, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xe455, lpOverlapped=0x0) returned 1 [0134.860] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe460, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xe460, lpOverlapped=0x0) returned 1 [0134.862] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.884] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.895] CloseHandle (hObject=0x10c) returned 1 [0134.895] CloseHandle (hObject=0x110) returned 1 [0134.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\3030303030303932393039365B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\3030303030303932393039365b315d.gif")) returned 0 [0134.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\3030303030303932393039365B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\3030303030303932393039365b315d.gif")) returned 0x2020 [0134.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 0x325098 [0134.896] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 0 [0134.896] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0134.896] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif")) returned 1 [0134.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif")) returned 0xffffffff [0134.898] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 1 [0134.898] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0134.898] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.898] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0134.898] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa3c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0134.898] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0134.898] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa3c) returned 0x10ab [0134.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\313232333835353332322D706F73746D65737361676572656C61795B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\313232333835353332322d706f73746d65737361676572656c61795b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0134.899] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2929 [0134.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0134.900] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0134.991] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2929, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2929, lpOverlapped=0x0) returned 1 [0134.993] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2930, lpOverlapped=0x0) returned 1 [0134.994] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.016] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.028] CloseHandle (hObject=0x110) returned 1 [0135.028] CloseHandle (hObject=0x10c) returned 1 [0135.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\313232333835353332322D706F73746D65737361676572656C61795B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\313232333835353332322d706f73746d65737361676572656c61795b315d.js")) returned 0 [0135.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\313232333835353332322D706F73746D65737361676572656C61795B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\313232333835353332322d706f73746d65737361676572656c61795b315d.js")) returned 0x2020 [0135.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 0x325098 [0135.029] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 0 [0135.029] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0135.029] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js")) returned 1 [0135.030] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js")) returned 0xffffffff [0135.030] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 1 [0135.030] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0135.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0135.030] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0135.031] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0135.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af58) returned 0x10ab [0135.031] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0135.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0135.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413365316F4F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413365316f4f5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0135.032] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0135.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0135.032] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0135.122] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x29b, lpOverlapped=0x0) returned 1 [0135.123] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2a0, lpOverlapped=0x0) returned 1 [0135.124] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.147] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.158] CloseHandle (hObject=0x10c) returned 1 [0135.158] CloseHandle (hObject=0x110) returned 1 [0135.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413365316F4F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413365316f4f5b315d.png")) returned 0 [0135.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413365316F4F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413365316f4f5b315d.png")) returned 0x2020 [0135.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 0x325098 [0135.159] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 0 [0135.159] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0135.159] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 1 [0135.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 0xffffffff [0135.160] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 1 [0135.161] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0135.161] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.161] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0135.161] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0135.161] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b094, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0135.161] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.161] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b094) returned 0x10ab [0135.161] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0135.161] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0135.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413432394E505B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413432394e505b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0135.162] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x265 [0135.162] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0135.163] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0135.244] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x265, lpOverlapped=0x0) returned 1 [0135.249] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x270, lpOverlapped=0x0) returned 1 [0135.250] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.272] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.283] CloseHandle (hObject=0x110) returned 1 [0135.283] CloseHandle (hObject=0x10c) returned 1 [0135.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413432394E505B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413432394e505b315d.png")) returned 0 [0135.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413432394E505B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413432394e505b315d.png")) returned 0x2020 [0135.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 0x325098 [0135.284] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 0 [0135.284] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0135.284] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 1 [0135.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 0xffffffff [0135.285] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 1 [0135.286] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0135.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0135.286] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0135.286] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b104, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0135.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b104) returned 0x10ab [0135.286] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0135.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0135.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413432706A595B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413432706a595b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0135.287] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x252 [0135.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0135.288] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0135.382] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x252, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x252, lpOverlapped=0x0) returned 1 [0135.384] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x260, lpOverlapped=0x0) returned 1 [0135.409] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.431] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.442] CloseHandle (hObject=0x10c) returned 1 [0135.442] CloseHandle (hObject=0x110) returned 1 [0135.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413432706A595B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413432706a595b315d.png")) returned 0 [0135.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413432706A595B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413432706a595b315d.png")) returned 0x2020 [0135.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 0x325098 [0135.444] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 0 [0135.444] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0135.444] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 1 [0135.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 0xffffffff [0135.445] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 1 [0135.445] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0135.445] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.445] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0135.445] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0135.445] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.445] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9b8) returned 0x10ab [0135.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0135.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413631414B4E5B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413631414b4e5b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0135.447] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x248 [0135.447] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0135.448] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0135.521] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x248, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x248, lpOverlapped=0x0) returned 1 [0135.523] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x250, lpOverlapped=0x0) returned 1 [0135.524] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.547] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.558] CloseHandle (hObject=0x110) returned 1 [0135.558] CloseHandle (hObject=0x10c) returned 1 [0135.558] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413631414B4E5B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413631414b4e5b325d.png")) returned 0 [0135.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41413631414B4E5B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41413631414b4e5b325d.png")) returned 0x2020 [0135.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 0x325098 [0135.559] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 0 [0135.559] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0135.559] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 1 [0135.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 0xffffffff [0135.560] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 1 [0135.561] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0135.561] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.561] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0135.561] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0135.561] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.561] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad8c) returned 0x10ab [0135.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0135.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4141364B697A505B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4141364b697a505b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0135.562] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21b [0135.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0135.562] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0135.677] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x21b, lpOverlapped=0x0) returned 1 [0135.679] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x220, lpOverlapped=0x0) returned 1 [0135.680] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.705] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.716] CloseHandle (hObject=0x10c) returned 1 [0135.716] CloseHandle (hObject=0x110) returned 1 [0135.716] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4141364B697A505B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4141364b697a505b325d.png")) returned 0 [0135.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4141364B697A505B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4141364b697a505b325d.png")) returned 0x2020 [0135.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 0x325098 [0135.717] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 0 [0135.717] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0135.717] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 1 [0135.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 0xffffffff [0135.718] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 1 [0135.718] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0135.718] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.719] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0135.719] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0135.719] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b068, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0135.719] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.719] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b068) returned 0x10ab [0135.719] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0135.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0135.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\414137584351335B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\414137584351335b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0135.723] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27b [0135.723] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0135.723] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0135.818] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x27b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x27b, lpOverlapped=0x0) returned 1 [0135.819] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x280, lpOverlapped=0x0) returned 1 [0135.821] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.843] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.856] CloseHandle (hObject=0x110) returned 1 [0135.856] CloseHandle (hObject=0x10c) returned 1 [0135.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\414137584351335B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\414137584351335b315d.png")) returned 0 [0135.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\414137584351335B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\414137584351335b315d.png")) returned 0x2020 [0135.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 0x325098 [0135.857] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 0 [0135.857] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0135.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 1 [0135.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 0xffffffff [0135.858] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 1 [0135.859] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0135.859] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.859] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0135.859] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0135.859] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b068, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0135.859] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.859] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b068) returned 0x10ab [0135.859] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0135.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0135.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\414138546176655B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\414138546176655b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0135.861] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x268 [0135.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0135.861] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0135.935] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x268, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x268, lpOverlapped=0x0) returned 1 [0135.937] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x270, lpOverlapped=0x0) returned 1 [0135.938] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.960] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.972] CloseHandle (hObject=0x10c) returned 1 [0135.972] CloseHandle (hObject=0x110) returned 1 [0135.972] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\414138546176655B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\414138546176655b315d.png")) returned 0 [0135.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\414138546176655B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\414138546176655b315d.png")) returned 0x2020 [0135.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 0x325098 [0135.973] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 0 [0135.973] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0135.973] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 1 [0135.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 0xffffffff [0135.974] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 1 [0135.974] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0135.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0135.974] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0135.975] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0135.975] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0135.975] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0135.975] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0135.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0135.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4141664F4944715B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4141664f4944715b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0135.976] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21e [0135.976] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0135.976] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0136.068] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x21e, lpOverlapped=0x0) returned 1 [0136.070] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x220, lpOverlapped=0x0) returned 1 [0136.071] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.093] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.105] CloseHandle (hObject=0x110) returned 1 [0136.105] CloseHandle (hObject=0x10c) returned 1 [0136.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4141664F4944715B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4141664f4944715b315d.png")) returned 0 [0136.105] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4141664F4944715B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4141664f4944715b315d.png")) returned 0x2020 [0136.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 0x325098 [0136.106] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 0 [0136.106] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0136.106] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 1 [0136.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 0xffffffff [0136.107] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 1 [0136.107] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0136.107] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.107] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0136.107] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0136.107] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.107] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9dc) returned 0x10ab [0136.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0136.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416B684D7A395B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416b684d7a395b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.108] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e3 [0136.108] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0136.108] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0136.215] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2e3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2e3, lpOverlapped=0x0) returned 1 [0136.217] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2f0, lpOverlapped=0x0) returned 1 [0136.220] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.243] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.257] CloseHandle (hObject=0x10c) returned 1 [0136.257] CloseHandle (hObject=0x110) returned 1 [0136.260] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416B684D7A395B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416b684d7a395b325d.png")) returned 0 [0136.261] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416B684D7A395B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416b684d7a395b325d.png")) returned 0x2020 [0136.261] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 0x325098 [0136.262] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 0 [0136.262] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0136.262] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 1 [0136.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 0xffffffff [0136.263] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 1 [0136.266] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0136.266] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.268] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0136.268] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0136.268] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.268] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adb4) returned 0x10ab [0136.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416D525932515B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416d525932515b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0136.269] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c [0136.270] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0136.270] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0136.359] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x12c, lpOverlapped=0x0) returned 1 [0136.360] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x130, lpOverlapped=0x0) returned 1 [0136.361] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.395] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.406] CloseHandle (hObject=0x110) returned 1 [0136.406] CloseHandle (hObject=0x10c) returned 1 [0136.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416D525932515B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416d525932515b315d.png")) returned 0 [0136.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416D525932515B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416d525932515b315d.png")) returned 0x2020 [0136.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 0x325098 [0136.407] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 0 [0136.407] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0136.407] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 1 [0136.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 0xffffffff [0136.408] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 1 [0136.408] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0136.408] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.408] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0136.408] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0136.409] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0136.409] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.409] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b090) returned 0x10ab [0136.409] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0136.409] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0136.409] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416E6938716B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416e6938716b5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.410] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x391 [0136.410] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0136.410] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0136.483] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x391, lpOverlapped=0x0) returned 1 [0136.550] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3a0, lpOverlapped=0x0) returned 1 [0136.551] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.573] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.584] CloseHandle (hObject=0x10c) returned 1 [0136.584] CloseHandle (hObject=0x110) returned 1 [0136.584] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416E6938716B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416e6938716b5b315d.png")) returned 0 [0136.585] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\41416E6938716B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\41416e6938716b5b315d.png")) returned 0x2020 [0136.585] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 0x325098 [0136.585] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 0 [0136.585] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0136.585] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 1 [0136.587] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 0xffffffff [0136.587] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 1 [0136.587] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0136.587] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.587] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0136.587] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0136.588] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0136.588] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.588] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b090) returned 0x10ab [0136.588] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0136.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\61646974696F6E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\61646974696f6e5b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0136.589] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a52 [0136.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0136.589] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0136.679] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7a52, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7a52, lpOverlapped=0x0) returned 1 [0136.688] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7a60, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7a60, lpOverlapped=0x0) returned 1 [0136.690] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.712] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.723] CloseHandle (hObject=0x110) returned 1 [0136.723] CloseHandle (hObject=0x10c) returned 1 [0136.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\61646974696F6E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\61646974696f6e5b315d.js")) returned 0 [0136.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\61646974696F6E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\61646974696f6e5b315d.js")) returned 0x2020 [0136.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 0x325098 [0136.724] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 0 [0136.724] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0136.724] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js")) returned 1 [0136.725] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js")) returned 0xffffffff [0136.725] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 1 [0136.725] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0136.725] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.726] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0136.726] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0136.726] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0136.726] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.726] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0136.726] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0136.726] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0136.735] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6173796E635F7573657273796E635B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6173796e635f7573657273796e635b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.736] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3 [0136.736] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0136.736] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0136.826] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3e3, lpOverlapped=0x0) returned 1 [0136.838] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3f0, lpOverlapped=0x0) returned 1 [0136.839] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.861] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.872] CloseHandle (hObject=0x10c) returned 1 [0136.873] CloseHandle (hObject=0x110) returned 1 [0136.873] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6173796E635F7573657273796E635B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6173796e635f7573657273796e635b315d.htm")) returned 0 [0136.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6173796E635F7573657273796E635B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6173796e635f7573657273796e635b315d.htm")) returned 0x2020 [0136.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 0x325098 [0136.874] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 0 [0136.874] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0136.874] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm")) returned 1 [0136.874] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm")) returned 0xffffffff [0136.874] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 1 [0136.875] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0136.875] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.875] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0136.875] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ade0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0136.875] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0136.875] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ade0) returned 0x10ab [0136.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62333637633037352D643938612D343537642D623337642D3364396538616235336538625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62333637633037352d643938612d343537642d623337642d3364396538616235336538625b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0136.876] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5feb [0136.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0136.876] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0136.967] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5feb, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x5feb, lpOverlapped=0x0) returned 1 [0136.984] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5ff0, lpOverlapped=0x0) returned 1 [0136.985] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.008] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.019] CloseHandle (hObject=0x110) returned 1 [0137.019] CloseHandle (hObject=0x10c) returned 1 [0137.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62333637633037352D643938612D343537642D623337642D3364396538616235336538625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62333637633037352d643938612d343537642d623337642d3364396538616235336538625b315d.jpg")) returned 0 [0137.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62333637633037352D643938612D343537642D623337642D3364396538616235336538625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62333637633037352d643938612d343537642d623337642d3364396538616235336538625b315d.jpg")) returned 0x2020 [0137.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 0x325098 [0137.020] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 0 [0137.020] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0137.020] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 1 [0137.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 0xffffffff [0137.022] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 1 [0137.022] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0137.022] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.022] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0137.022] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0137.023] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0137.023] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.023] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b0) returned 0x10ab [0137.023] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0137.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0137.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242386A634F725B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242386a634f725b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.024] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1aa [0137.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0137.024] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0137.115] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1aa, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1aa, lpOverlapped=0x0) returned 1 [0137.134] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1b0, lpOverlapped=0x0) returned 1 [0137.135] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.158] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.169] CloseHandle (hObject=0x10c) returned 1 [0137.169] CloseHandle (hObject=0x110) returned 1 [0137.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242386A634F725B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242386a634f725b325d.png")) returned 0 [0137.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242386A634F725B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242386a634f725b325d.png")) returned 0x2020 [0137.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 0x325098 [0137.170] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 0 [0137.170] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0137.170] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 1 [0137.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 0xffffffff [0137.171] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 1 [0137.171] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0137.171] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.171] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0137.171] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0137.172] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0137.172] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.172] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f8) returned 0x10ab [0137.172] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0137.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242385A624D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242385a624d5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0137.173] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c22 [0137.173] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0137.173] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0137.255] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c22, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c22, lpOverlapped=0x0) returned 1 [0137.256] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1c30, lpOverlapped=0x0) returned 1 [0137.257] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.280] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.291] CloseHandle (hObject=0x110) returned 1 [0137.291] CloseHandle (hObject=0x10c) returned 1 [0137.291] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242385A624D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242385a624d5b315d.jpg")) returned 0 [0137.292] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242385A624D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242385a624d5b315d.jpg")) returned 0x2020 [0137.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 0x325098 [0137.292] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 0 [0137.292] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0137.292] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 1 [0137.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 0xffffffff [0137.293] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 1 [0137.293] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0137.293] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0137.294] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0137.294] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0137.294] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0137.294] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0137.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0137.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242397748305B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242397748305b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.295] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x234 [0137.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0137.295] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0137.402] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x234, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x234, lpOverlapped=0x0) returned 1 [0137.411] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x240, lpOverlapped=0x0) returned 1 [0137.412] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.435] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.446] CloseHandle (hObject=0x10c) returned 1 [0137.446] CloseHandle (hObject=0x110) returned 1 [0137.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242397748305B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242397748305b315d.png")) returned 0 [0137.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242397748305B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242397748305b315d.png")) returned 0x2020 [0137.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 0x325098 [0137.447] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 0 [0137.447] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0137.447] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 1 [0137.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 0xffffffff [0137.448] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 1 [0137.449] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0137.449] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.449] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0137.449] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0137.449] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0137.449] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.449] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0137.449] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0137.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424243466A6F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424243466a6f5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0137.450] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ac7 [0137.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0137.451] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0137.524] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2ac7, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2ac7, lpOverlapped=0x0) returned 1 [0137.528] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2ad0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2ad0, lpOverlapped=0x0) returned 1 [0137.529] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.551] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.562] CloseHandle (hObject=0x110) returned 1 [0137.562] CloseHandle (hObject=0x10c) returned 1 [0137.563] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424243466A6F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424243466a6f5b315d.jpg")) returned 0 [0137.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424243466A6F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424243466a6f5b315d.jpg")) returned 0x2020 [0137.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 0x325098 [0137.563] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 0 [0137.564] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0137.564] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 1 [0137.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 0xffffffff [0137.565] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 1 [0137.565] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0137.565] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.565] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0137.565] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab54, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0137.565] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.565] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab54) returned 0x10ab [0137.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0137.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424474634D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424474634d5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.567] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c9 [0137.567] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0137.567] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0137.675] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7c9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7c9, lpOverlapped=0x0) returned 1 [0137.677] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7d0, lpOverlapped=0x0) returned 1 [0137.678] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.700] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.712] CloseHandle (hObject=0x10c) returned 1 [0137.712] CloseHandle (hObject=0x110) returned 1 [0137.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424474634D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424474634d5b315d.jpg")) returned 0 [0137.713] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424474634D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424474634d5b315d.jpg")) returned 0x2020 [0137.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 0x325098 [0137.713] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 0 [0137.713] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0137.713] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 1 [0137.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 0xffffffff [0137.714] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 1 [0137.714] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0137.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0137.714] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0137.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae4c) returned 0x10ab [0137.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424249654E4A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424249654e4a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0137.716] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f19 [0137.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0137.716] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0137.806] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f19, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1f19, lpOverlapped=0x0) returned 1 [0137.808] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1f20, lpOverlapped=0x0) returned 1 [0137.809] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.832] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.844] CloseHandle (hObject=0x110) returned 1 [0137.844] CloseHandle (hObject=0x10c) returned 1 [0137.844] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424249654E4A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424249654e4a5b315d.jpg")) returned 0 [0137.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424249654E4A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424249654e4a5b315d.jpg")) returned 0x2020 [0137.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 0x325098 [0137.845] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 0 [0137.845] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0137.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 1 [0137.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 0xffffffff [0137.846] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1 [0137.846] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0137.846] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.846] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0137.846] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0137.847] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0137.847] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.847] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0137.847] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0137.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0137.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242496D4B585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242496d4b585b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.848] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x711 [0137.849] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0137.849] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0137.922] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x711, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x711, lpOverlapped=0x0) returned 1 [0137.924] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x720, lpOverlapped=0x0) returned 1 [0137.925] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.947] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.958] CloseHandle (hObject=0x10c) returned 1 [0137.958] CloseHandle (hObject=0x110) returned 1 [0137.959] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242496D4B585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242496d4b585b315d.jpg")) returned 0 [0137.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242496D4B585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242496d4b585b315d.jpg")) returned 0x2020 [0137.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0x325098 [0137.960] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0 [0137.960] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0137.960] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 1 [0137.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 0xffffffff [0137.961] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 1 [0137.961] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0137.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0137.961] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0137.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0137.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9f0) returned 0x10ab [0137.961] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424C3452395B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424c3452395b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0137.962] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2569 [0137.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0137.962] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0138.050] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2569, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2569, lpOverlapped=0x0) returned 1 [0138.059] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2570, lpOverlapped=0x0) returned 1 [0138.060] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.083] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.098] CloseHandle (hObject=0x110) returned 1 [0138.098] CloseHandle (hObject=0x10c) returned 1 [0138.099] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424C3452395B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424c3452395b315d.jpg")) returned 0 [0138.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424C3452395B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424c3452395b315d.jpg")) returned 0x2020 [0138.100] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 0x325098 [0138.100] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 0 [0138.100] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0138.100] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 1 [0138.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 0xffffffff [0138.102] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 1 [0138.102] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0138.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0138.102] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0138.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac74) returned 0x10ab [0138.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0138.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424C68545A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424c68545a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.105] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30d2 [0138.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0138.105] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0138.192] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x30d2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x30d2, lpOverlapped=0x0) returned 1 [0138.202] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x30e0, lpOverlapped=0x0) returned 1 [0138.203] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.226] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.237] CloseHandle (hObject=0x10c) returned 1 [0138.237] CloseHandle (hObject=0x110) returned 1 [0138.237] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424C68545A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424c68545a5b315d.jpg")) returned 0 [0138.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242424C68545A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242424c68545a5b315d.jpg")) returned 0x2020 [0138.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 0x325098 [0138.238] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 0 [0138.238] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0138.238] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 1 [0138.239] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 0xffffffff [0138.239] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 1 [0138.239] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0138.239] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.240] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0138.240] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0138.240] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0138.240] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.240] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0138.240] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0138.240] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242426E685A595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242426e685a595b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0138.241] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b9 [0138.241] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0138.242] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0138.329] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9b9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9b9, lpOverlapped=0x0) returned 1 [0138.331] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9c0, lpOverlapped=0x0) returned 1 [0138.332] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.354] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.366] CloseHandle (hObject=0x110) returned 1 [0138.366] CloseHandle (hObject=0x10c) returned 1 [0138.366] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242426E685A595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242426e685a595b315d.jpg")) returned 0 [0138.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242426E685A595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242426e685a595b315d.jpg")) returned 0x2020 [0138.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 0x325098 [0138.367] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 0 [0138.367] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0138.367] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 1 [0138.368] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 0xffffffff [0138.368] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 1 [0138.368] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0138.368] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.368] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0138.368] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0138.369] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0138.369] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.369] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0138.369] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0138.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0138.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506841725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506841725b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.370] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48f4 [0138.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0138.370] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0138.456] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x48f4, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x48f4, lpOverlapped=0x0) returned 1 [0138.459] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x4900, lpOverlapped=0x0) returned 1 [0138.460] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.481] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.493] CloseHandle (hObject=0x10c) returned 1 [0138.493] CloseHandle (hObject=0x110) returned 1 [0138.493] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506841725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506841725b315d.jpg")) returned 0 [0138.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506841725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506841725b315d.jpg")) returned 0x2020 [0138.494] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 0x325098 [0138.494] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 0 [0138.494] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0138.494] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 1 [0138.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 0xffffffff [0138.495] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 1 [0138.495] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0138.495] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.495] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0138.495] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0138.496] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0c8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0138.496] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.496] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0c8) returned 0x10ab [0138.496] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0138.496] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.496] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506962795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506962795b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0138.497] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c21 [0138.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0138.497] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0138.588] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c21, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c21, lpOverlapped=0x0) returned 1 [0138.590] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1c30, lpOverlapped=0x0) returned 1 [0138.591] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.613] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.624] CloseHandle (hObject=0x110) returned 1 [0138.624] CloseHandle (hObject=0x10c) returned 1 [0138.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506962795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506962795b315d.jpg")) returned 0 [0138.625] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506962795B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506962795b315d.jpg")) returned 0x2020 [0138.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 0x325098 [0138.625] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 0 [0138.625] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0138.625] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 1 [0138.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 0xffffffff [0138.626] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 1 [0138.626] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0138.626] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.626] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0138.626] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0138.626] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.626] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e8) returned 0x10ab [0138.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0138.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506D584A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506d584a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.627] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16bf [0138.627] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0138.628] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0138.714] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16bf, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x16bf, lpOverlapped=0x0) returned 1 [0138.721] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x16c0, lpOverlapped=0x0) returned 1 [0138.722] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.744] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.755] CloseHandle (hObject=0x10c) returned 1 [0138.755] CloseHandle (hObject=0x110) returned 1 [0138.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506D584A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506d584a5b315d.jpg")) returned 0 [0138.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242506D584A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242506d584a5b315d.jpg")) returned 0x2020 [0138.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 0x325098 [0138.757] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 0 [0138.757] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0138.757] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 1 [0138.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 0xffffffff [0138.758] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 1 [0138.758] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0138.758] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.759] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0138.759] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0138.759] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.759] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac58) returned 0x10ab [0138.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242505333375B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242505333375b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0138.760] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21feb [0138.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0138.760] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0138.834] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x21feb, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x21feb, lpOverlapped=0x0) returned 1 [0138.838] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x21ff0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x21ff0, lpOverlapped=0x0) returned 1 [0138.841] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.863] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.874] CloseHandle (hObject=0x110) returned 1 [0138.874] CloseHandle (hObject=0x10c) returned 1 [0138.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242505333375B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242505333375b315d.png")) returned 0 [0138.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242505333375B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242505333375b315d.png")) returned 0x2020 [0138.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 0x325098 [0138.875] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 0 [0138.875] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0138.875] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 1 [0138.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 0xffffffff [0138.877] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 1 [0138.878] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0138.879] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.879] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0138.879] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0138.879] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0138.879] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0138.879] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0138.879] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0138.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0138.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242516942465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242516942465b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.880] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f9 [0138.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0138.880] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0138.969] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12f9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x12f9, lpOverlapped=0x0) returned 1 [0138.971] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1300, lpOverlapped=0x0) returned 1 [0138.972] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.995] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.006] CloseHandle (hObject=0x10c) returned 1 [0139.006] CloseHandle (hObject=0x110) returned 1 [0139.006] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242516942465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242516942465b315d.jpg")) returned 0 [0139.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242516942465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242516942465b315d.jpg")) returned 0x2020 [0139.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 0x325098 [0139.007] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 0 [0139.007] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0139.007] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 1 [0139.008] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 0xffffffff [0139.008] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 1 [0139.008] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0139.008] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.008] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0139.008] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0139.009] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0139.009] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.009] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0139.009] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0139.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242747938685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242747938685b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0139.013] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a9 [0139.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0139.013] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0139.102] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9a9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9a9, lpOverlapped=0x0) returned 1 [0139.104] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9b0, lpOverlapped=0x0) returned 1 [0139.105] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.127] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.138] CloseHandle (hObject=0x110) returned 1 [0139.138] CloseHandle (hObject=0x10c) returned 1 [0139.139] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242747938685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242747938685b315d.jpg")) returned 0 [0139.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242747938685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242747938685b315d.jpg")) returned 0x2020 [0139.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 0x325098 [0139.139] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 0 [0139.139] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0139.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 1 [0139.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 0xffffffff [0139.140] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 1 [0139.141] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0139.141] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.141] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0139.141] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0139.141] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.141] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0139.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0139.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242425641434C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242425641434c5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.143] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b08 [0139.143] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0139.143] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0139.247] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1b08, lpOverlapped=0x0) returned 1 [0139.250] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1b10, lpOverlapped=0x0) returned 1 [0139.251] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.275] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.285] CloseHandle (hObject=0x10c) returned 1 [0139.285] CloseHandle (hObject=0x110) returned 1 [0139.286] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242425641434C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242425641434c5b315d.jpg")) returned 0 [0139.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242425641434C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242425641434c5b315d.jpg")) returned 0x2020 [0139.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 0x325098 [0139.287] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 0 [0139.287] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0139.287] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg")) returned 1 [0139.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg")) returned 0xffffffff [0139.288] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 1 [0139.289] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0139.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0139.289] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0139.289] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0139.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af6c) returned 0x10ab [0139.289] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0139.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242564779525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242564779525b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0139.291] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c41 [0139.291] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0139.291] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0139.364] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c41, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c41, lpOverlapped=0x0) returned 1 [0139.366] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1c50, lpOverlapped=0x0) returned 1 [0139.367] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.415] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.426] CloseHandle (hObject=0x110) returned 1 [0139.426] CloseHandle (hObject=0x10c) returned 1 [0139.426] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242564779525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242564779525b315d.jpg")) returned 0 [0139.427] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242564779525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242564779525b315d.jpg")) returned 0x2020 [0139.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 0x325098 [0139.427] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 0 [0139.427] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0139.427] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg")) returned 1 [0139.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg")) returned 0xffffffff [0139.428] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 1 [0139.428] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0139.428] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.429] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0139.429] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0139.429] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0139.429] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.429] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0fc) returned 0x10ab [0139.429] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0139.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0139.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242564D74585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242564d74585b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.431] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x950 [0139.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0139.431] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0139.504] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x950, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x950, lpOverlapped=0x0) returned 1 [0139.506] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x960, lpOverlapped=0x0) returned 1 [0139.507] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.529] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.540] CloseHandle (hObject=0x10c) returned 1 [0139.540] CloseHandle (hObject=0x110) returned 1 [0139.541] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242564D74585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242564d74585b315d.jpg")) returned 0 [0139.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242564D74585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242564d74585b315d.jpg")) returned 0x2020 [0139.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 0x325098 [0139.542] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 0 [0139.542] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0139.542] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg")) returned 1 [0139.543] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg")) returned 0xffffffff [0139.543] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 1 [0139.543] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0139.543] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.543] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0139.543] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0139.543] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.543] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9dc) returned 0x10ab [0139.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242565973755B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242565973755b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0139.547] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bba [0139.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0139.547] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0139.651] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1bba, lpOverlapped=0x0) returned 1 [0139.653] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1bc0, lpOverlapped=0x0) returned 1 [0139.654] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.676] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.687] CloseHandle (hObject=0x110) returned 1 [0139.687] CloseHandle (hObject=0x10c) returned 1 [0139.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242565973755B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242565973755b315d.jpg")) returned 0 [0139.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242565973755B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242565973755b315d.jpg")) returned 0x2020 [0139.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 0x325098 [0139.688] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 0 [0139.688] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0139.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg")) returned 1 [0139.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg")) returned 0xffffffff [0139.689] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 1 [0139.690] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0139.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0139.690] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0139.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac50) returned 0x10ab [0139.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0139.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242574C74575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242574c74575b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.691] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76a [0139.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0139.691] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0139.779] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x76a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x76a, lpOverlapped=0x0) returned 1 [0139.781] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x770, lpOverlapped=0x0) returned 1 [0139.781] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.804] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.815] CloseHandle (hObject=0x10c) returned 1 [0139.815] CloseHandle (hObject=0x110) returned 1 [0139.815] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242574C74575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242574c74575b315d.jpg")) returned 0 [0139.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242574C74575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242574c74575b315d.jpg")) returned 0x2020 [0139.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 0x325098 [0139.816] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 0 [0139.816] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0139.816] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg")) returned 1 [0139.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg")) returned 0xffffffff [0139.817] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 1 [0139.818] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0139.818] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.818] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0139.818] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0139.818] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0139.818] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.818] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0139.818] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0139.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242583378425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242583378425b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0139.827] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95f [0139.827] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0139.828] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0139.905] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x95f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x95f, lpOverlapped=0x0) returned 1 [0139.907] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x960, lpOverlapped=0x0) returned 1 [0139.908] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.932] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.944] CloseHandle (hObject=0x110) returned 1 [0139.944] CloseHandle (hObject=0x10c) returned 1 [0139.944] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242583378425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242583378425b315d.jpg")) returned 0 [0139.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242583378425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242583378425b315d.jpg")) returned 0x2020 [0139.945] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 0x325098 [0139.945] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 0 [0139.945] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0139.945] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg")) returned 1 [0139.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg")) returned 0xffffffff [0139.946] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 1 [0139.947] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0139.947] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.947] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0139.947] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0139.947] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0139.947] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0139.947] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0139.947] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0139.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0139.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242593938655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242593938655b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.949] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x241e [0139.949] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0139.949] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0140.037] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x241e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x241e, lpOverlapped=0x0) returned 1 [0140.039] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2420, lpOverlapped=0x0) returned 1 [0140.040] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.062] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.073] CloseHandle (hObject=0x10c) returned 1 [0140.073] CloseHandle (hObject=0x110) returned 1 [0140.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242593938655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242593938655b315d.jpg")) returned 0 [0140.074] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424242593938655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424242593938655b315d.jpg")) returned 0x2020 [0140.074] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 0x325098 [0140.074] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 0 [0140.074] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0140.074] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg")) returned 1 [0140.075] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg")) returned 0xffffffff [0140.075] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 1 [0140.076] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0140.076] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.076] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0140.076] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0140.076] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.076] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0140.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0140.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242425A5956505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242425a5956505b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0140.077] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x938 [0140.077] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0140.077] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0140.166] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x938, lpOverlapped=0x0) returned 1 [0140.167] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x940, lpOverlapped=0x0) returned 1 [0140.168] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.191] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.201] CloseHandle (hObject=0x110) returned 1 [0140.201] CloseHandle (hObject=0x10c) returned 1 [0140.202] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242425A5956505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242425a5956505b315d.jpg")) returned 0 [0140.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242425A5956505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242425a5956505b315d.jpg")) returned 0x2020 [0140.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 0x325098 [0140.202] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 0 [0140.203] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0140.203] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg")) returned 1 [0140.203] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg")) returned 0xffffffff [0140.204] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1 [0140.204] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0140.204] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.204] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0140.204] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0140.204] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0140.204] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.204] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af6c) returned 0x10ab [0140.205] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0140.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0140.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330346F325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330346f325b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0140.206] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192a [0140.206] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0140.206] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0140.304] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x192a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x192a, lpOverlapped=0x0) returned 1 [0140.306] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1930, lpOverlapped=0x0) returned 1 [0140.307] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.331] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.341] CloseHandle (hObject=0x10c) returned 1 [0140.342] CloseHandle (hObject=0x110) returned 1 [0140.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330346F325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330346f325b315d.jpg")) returned 0 [0140.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330346F325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330346f325b315d.jpg")) returned 0x2020 [0140.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0x325098 [0140.343] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0 [0140.343] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0140.343] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg")) returned 1 [0140.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg")) returned 0xffffffff [0140.344] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 1 [0140.344] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0140.344] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.344] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0140.344] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0140.344] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0140.345] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.345] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0fc) returned 0x10ab [0140.345] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0140.345] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0140.345] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330346F6B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330346f6b5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0140.346] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23fb [0140.346] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0140.346] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0140.430] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x23fb, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x23fb, lpOverlapped=0x0) returned 1 [0140.437] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2400, lpOverlapped=0x0) returned 1 [0140.438] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.461] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.472] CloseHandle (hObject=0x110) returned 1 [0140.472] CloseHandle (hObject=0x10c) returned 1 [0140.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330346F6B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330346f6b5b315d.jpg")) returned 0 [0140.473] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330346F6B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330346f6b5b315d.jpg")) returned 0x2020 [0140.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 0x325098 [0140.474] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 0 [0140.474] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0140.474] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg")) returned 1 [0140.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg")) returned 0xffffffff [0140.475] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 1 [0140.475] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0140.475] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.475] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0140.475] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0140.475] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.475] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9dc) returned 0x10ab [0140.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0140.476] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243303477655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243303477655b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0140.476] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a99 [0140.476] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0140.477] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0140.572] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2a99, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2a99, lpOverlapped=0x0) returned 1 [0140.574] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2aa0, lpOverlapped=0x0) returned 1 [0140.575] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.598] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.609] CloseHandle (hObject=0x10c) returned 1 [0140.609] CloseHandle (hObject=0x110) returned 1 [0140.609] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243303477655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243303477655b315d.jpg")) returned 0 [0140.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243303477655B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243303477655b315d.jpg")) returned 0x2020 [0140.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 0x325098 [0140.610] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 0 [0140.610] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0140.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg")) returned 1 [0140.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg")) returned 0xffffffff [0140.611] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 1 [0140.612] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0140.612] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.612] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0140.612] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0140.612] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.612] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac50) returned 0x10ab [0140.612] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0140.612] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433035726C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433035726c5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0140.613] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3200 [0140.613] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0140.613] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0140.686] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3200, lpOverlapped=0x0) returned 1 [0140.688] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3210, lpOverlapped=0x0) returned 1 [0140.690] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.712] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.723] CloseHandle (hObject=0x110) returned 1 [0140.723] CloseHandle (hObject=0x10c) returned 1 [0140.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433035726C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433035726c5b315d.jpg")) returned 0 [0140.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433035726C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433035726c5b315d.jpg")) returned 0x2020 [0140.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 0x325098 [0140.724] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 0 [0140.724] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0140.724] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg")) returned 1 [0140.725] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg")) returned 0xffffffff [0140.725] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 1 [0140.726] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0140.726] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.726] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0140.726] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0140.726] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0140.726] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.726] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0140.726] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0140.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0140.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433035726C5B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433035726c5b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0140.728] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e1 [0140.728] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0140.728] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0140.817] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7e1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7e1, lpOverlapped=0x0) returned 1 [0140.818] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7f0, lpOverlapped=0x0) returned 1 [0140.819] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.842] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.853] CloseHandle (hObject=0x10c) returned 1 [0140.853] CloseHandle (hObject=0x110) returned 1 [0140.853] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433035726C5B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433035726c5b325d.jpg")) returned 0 [0140.854] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433035726C5B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433035726c5b325d.jpg")) returned 0x2020 [0140.854] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 0x325098 [0140.854] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 0 [0140.854] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0140.854] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg")) returned 1 [0140.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg")) returned 0xffffffff [0140.855] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 1 [0140.856] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0140.856] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.856] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0140.856] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0140.856] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0140.856] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.856] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0140.856] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0140.856] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0140.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433041546A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433041546a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0140.858] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b4e [0140.858] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0140.858] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0140.948] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b4e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1b4e, lpOverlapped=0x0) returned 1 [0140.949] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1b50, lpOverlapped=0x0) returned 1 [0140.950] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.973] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.984] CloseHandle (hObject=0x110) returned 1 [0140.984] CloseHandle (hObject=0x10c) returned 1 [0140.984] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433041546A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433041546a5b315d.jpg")) returned 0 [0140.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242433041546A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242433041546a5b315d.jpg")) returned 0x2020 [0140.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 0x325098 [0140.985] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 0 [0140.985] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0140.985] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg")) returned 1 [0140.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg")) returned 0xffffffff [0140.986] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 1 [0140.987] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0140.987] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.987] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0140.987] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0140.987] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0140.987] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0140.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0140.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243304438695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243304438695b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0140.988] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x751 [0140.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0140.988] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0141.084] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x751, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x751, lpOverlapped=0x0) returned 1 [0141.085] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x760, lpOverlapped=0x0) returned 1 [0141.086] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.109] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.120] CloseHandle (hObject=0x10c) returned 1 [0141.120] CloseHandle (hObject=0x110) returned 1 [0141.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243304438695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243304438695b315d.jpg")) returned 0 [0141.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243304438695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243304438695b315d.jpg")) returned 0x2020 [0141.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 0x325098 [0141.121] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 0 [0141.121] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0141.121] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg")) returned 1 [0141.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg")) returned 0xffffffff [0141.122] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1 [0141.123] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0141.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0141.123] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0141.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0141.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af6c) returned 0x10ab [0141.123] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0141.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0141.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243306737615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243306737615b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0141.125] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200e [0141.125] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0141.125] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0141.198] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x200e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x200e, lpOverlapped=0x0) returned 1 [0141.200] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2010, lpOverlapped=0x0) returned 1 [0141.201] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.223] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.235] CloseHandle (hObject=0x110) returned 1 [0141.235] CloseHandle (hObject=0x10c) returned 1 [0141.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243306737615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243306737615b315d.jpg")) returned 0 [0141.236] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243306737615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243306737615b315d.jpg")) returned 0x2020 [0141.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0x325098 [0141.236] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0 [0141.236] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0141.236] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg")) returned 1 [0141.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg")) returned 0xffffffff [0141.237] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 1 [0141.237] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0141.237] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.237] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0141.238] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0141.238] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0141.238] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.238] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0fc) returned 0x10ab [0141.238] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0141.238] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0141.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243307731625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243307731625b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0141.242] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dcb [0141.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0141.242] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0141.345] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1dcb, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1dcb, lpOverlapped=0x0) returned 1 [0141.346] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1dd0, lpOverlapped=0x0) returned 1 [0141.347] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.370] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.405] CloseHandle (hObject=0x10c) returned 1 [0141.405] CloseHandle (hObject=0x110) returned 1 [0141.405] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243307731625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243307731625b315d.jpg")) returned 0 [0141.406] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424243307731625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424243307731625b315d.jpg")) returned 0x2020 [0141.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 0x325098 [0141.406] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 0 [0141.406] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0141.406] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg")) returned 1 [0141.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg")) returned 0xffffffff [0141.407] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 1 [0141.408] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0141.408] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.408] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0141.408] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0141.408] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.408] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9dc) returned 0x10ab [0141.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0141.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330784C745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330784c745b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0141.409] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23ba [0141.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0141.409] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0141.482] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x23ba, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x23ba, lpOverlapped=0x0) returned 1 [0141.483] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x23c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x23c0, lpOverlapped=0x0) returned 1 [0141.485] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.508] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.519] CloseHandle (hObject=0x110) returned 1 [0141.519] CloseHandle (hObject=0x10c) returned 1 [0141.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330784C745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330784c745b315d.jpg")) returned 0 [0141.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424330784C745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424330784c745b315d.jpg")) returned 0x2020 [0141.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 0x325098 [0141.520] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 0 [0141.520] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0141.520] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg")) returned 1 [0141.521] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg")) returned 0xffffffff [0141.521] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 1 [0141.522] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0141.522] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.522] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0141.522] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0141.522] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.522] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac50) returned 0x10ab [0141.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0141.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424244574132325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424244574132325b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0141.523] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb58 [0141.523] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0141.523] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0141.629] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb58, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xb58, lpOverlapped=0x0) returned 1 [0141.738] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb60, lpOverlapped=0x0) returned 1 [0141.747] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.770] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.784] CloseHandle (hObject=0x10c) returned 1 [0141.784] CloseHandle (hObject=0x110) returned 1 [0141.786] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424244574132325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424244574132325b315d.jpg")) returned 0 [0141.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424244574132325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424244574132325b315d.jpg")) returned 0x2020 [0141.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 0x325098 [0141.787] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 0 [0141.787] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0141.787] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg")) returned 1 [0141.789] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg")) returned 0xffffffff [0141.789] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 1 [0141.791] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0141.791] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.794] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0141.794] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0141.794] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0141.794] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.794] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0141.794] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0141.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0141.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245376433625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245376433625b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0141.796] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91d [0141.796] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0141.797] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0141.898] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x91d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x91d, lpOverlapped=0x0) returned 1 [0141.931] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x920, lpOverlapped=0x0) returned 1 [0141.932] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.955] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.966] CloseHandle (hObject=0x110) returned 1 [0141.966] CloseHandle (hObject=0x10c) returned 1 [0141.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245376433625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245376433625b315d.jpg")) returned 0 [0141.967] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245376433625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245376433625b315d.jpg")) returned 0x2020 [0141.967] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 0x325098 [0141.967] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 0 [0141.967] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0141.967] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg")) returned 1 [0141.968] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg")) returned 0xffffffff [0141.968] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 1 [0141.968] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0141.968] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.968] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0141.968] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0141.969] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0141.969] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0141.969] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0141.969] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0141.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0141.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424538356C645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424538356c645b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0141.970] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2850 [0141.970] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0141.970] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0142.060] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2850, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2850, lpOverlapped=0x0) returned 1 [0142.062] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2860, lpOverlapped=0x0) returned 1 [0142.063] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.086] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.109] CloseHandle (hObject=0x10c) returned 1 [0142.109] CloseHandle (hObject=0x110) returned 1 [0142.110] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424538356C645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424538356c645b315d.jpg")) returned 0 [0142.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424538356C645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424538356c645b315d.jpg")) returned 0x2020 [0142.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 0x325098 [0142.111] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 0 [0142.111] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0142.111] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg")) returned 1 [0142.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg")) returned 0xffffffff [0142.112] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 1 [0142.112] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0142.112] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0142.112] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0142.112] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0142.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0142.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424564636B705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424564636b705b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0142.113] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16ca [0142.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0142.114] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0142.188] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16ca, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x16ca, lpOverlapped=0x0) returned 1 [0142.191] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x16d0, lpOverlapped=0x0) returned 1 [0142.192] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.215] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.225] CloseHandle (hObject=0x110) returned 1 [0142.225] CloseHandle (hObject=0x10c) returned 1 [0142.225] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424564636B705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424564636b705b315d.jpg")) returned 0 [0142.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424564636B705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424564636b705b315d.jpg")) returned 0x2020 [0142.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 0x325098 [0142.226] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 0 [0142.226] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0142.226] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg")) returned 1 [0142.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg")) returned 0xffffffff [0142.227] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 1 [0142.228] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0142.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0142.228] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0142.228] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0142.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af6c) returned 0x10ab [0142.228] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0142.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0142.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245644D63695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245644d63695b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0142.236] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xafe [0142.236] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0142.236] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0142.334] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xafe, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xafe, lpOverlapped=0x0) returned 1 [0142.336] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb00, lpOverlapped=0x0) returned 1 [0142.337] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.360] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.370] CloseHandle (hObject=0x10c) returned 1 [0142.370] CloseHandle (hObject=0x110) returned 1 [0142.371] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245644D63695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245644d63695b315d.jpg")) returned 0 [0142.371] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245644D63695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245644d63695b315d.jpg")) returned 0x2020 [0142.371] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 0x325098 [0142.372] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 0 [0142.372] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0142.372] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg")) returned 1 [0142.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg")) returned 0xffffffff [0142.373] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 1 [0142.373] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0142.373] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.373] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0142.373] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0142.374] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0142.374] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.374] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0fc) returned 0x10ab [0142.374] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0142.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0142.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424564534C565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424564534c565b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0142.375] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a48 [0142.375] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0142.375] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0142.473] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2a48, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2a48, lpOverlapped=0x0) returned 1 [0142.475] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2a50, lpOverlapped=0x0) returned 1 [0142.476] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.499] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.509] CloseHandle (hObject=0x110) returned 1 [0142.509] CloseHandle (hObject=0x10c) returned 1 [0142.510] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424564534C565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424564534c565b315d.jpg")) returned 0 [0142.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424564534C565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424564534c565b315d.jpg")) returned 0x2020 [0142.510] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 0x325098 [0142.511] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 0 [0142.511] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0142.511] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg")) returned 1 [0142.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg")) returned 0xffffffff [0142.512] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 1 [0142.512] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0142.512] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.512] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0142.512] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0142.512] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.512] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9dc) returned 0x10ab [0142.512] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0142.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245653250645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245653250645b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0142.515] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x87f [0142.515] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0142.515] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0142.604] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x87f, lpOverlapped=0x0) returned 1 [0142.606] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x880, lpOverlapped=0x0) returned 1 [0142.607] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.630] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.643] CloseHandle (hObject=0x10c) returned 1 [0142.643] CloseHandle (hObject=0x110) returned 1 [0142.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245653250645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245653250645b315d.jpg")) returned 0 [0142.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245653250645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245653250645b315d.jpg")) returned 0x2020 [0142.644] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 0x325098 [0142.644] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 0 [0142.644] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0142.644] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg")) returned 1 [0142.645] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg")) returned 0xffffffff [0142.645] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 1 [0142.645] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0142.645] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.645] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0142.645] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0142.645] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.645] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac50) returned 0x10ab [0142.646] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0142.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424565344F6F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424565344f6f5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0142.647] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3faf [0142.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0142.647] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0142.736] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3faf, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3faf, lpOverlapped=0x0) returned 1 [0142.738] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3fb0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3fb0, lpOverlapped=0x0) returned 1 [0142.740] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.762] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.774] CloseHandle (hObject=0x110) returned 1 [0142.774] CloseHandle (hObject=0x10c) returned 1 [0142.774] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424565344F6F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424565344f6f5b315d.png")) returned 0 [0142.774] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424565344F6F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424565344f6f5b315d.png")) returned 0x2020 [0142.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 0x325098 [0142.775] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 0 [0142.775] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0142.775] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png")) returned 1 [0142.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png")) returned 0xffffffff [0142.776] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 1 [0142.776] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0142.776] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.776] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0142.776] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0142.777] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0142.777] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.777] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0142.777] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0142.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0142.778] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245653645775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245653645775b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0142.779] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa9 [0142.779] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0142.779] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0142.855] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaa9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xaa9, lpOverlapped=0x0) returned 1 [0142.862] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xab0, lpOverlapped=0x0) returned 1 [0142.863] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.893] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.904] CloseHandle (hObject=0x10c) returned 1 [0142.904] CloseHandle (hObject=0x110) returned 1 [0142.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245653645775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245653645775b315d.jpg")) returned 0 [0142.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245653645775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245653645775b315d.jpg")) returned 0x2020 [0142.905] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 0x325098 [0142.905] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 0 [0142.905] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0142.905] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg")) returned 1 [0142.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg")) returned 0xffffffff [0142.906] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 1 [0142.907] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0142.907] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.907] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0142.907] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0142.907] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0142.907] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0142.907] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0142.907] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0142.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0142.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245654670335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245654670335b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0142.909] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d26 [0142.909] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0142.909] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0142.999] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d26, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1d26, lpOverlapped=0x0) returned 1 [0143.001] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1d30, lpOverlapped=0x0) returned 1 [0143.002] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.024] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.035] CloseHandle (hObject=0x110) returned 1 [0143.036] CloseHandle (hObject=0x10c) returned 1 [0143.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245654670335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245654670335b315d.jpg")) returned 0 [0143.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245654670335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245654670335b315d.jpg")) returned 0x2020 [0143.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 0x325098 [0143.037] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 0 [0143.037] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0143.037] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg")) returned 1 [0143.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg")) returned 0xffffffff [0143.038] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 1 [0143.038] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0143.038] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.038] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0143.038] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0143.038] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.038] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0143.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0143.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245654777555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245654777555b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0143.039] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x780 [0143.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0143.040] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0143.129] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x780, lpOverlapped=0x0) returned 1 [0143.131] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x790, lpOverlapped=0x0) returned 1 [0143.132] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.155] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.166] CloseHandle (hObject=0x10c) returned 1 [0143.166] CloseHandle (hObject=0x110) returned 1 [0143.166] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245654777555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245654777555b315d.jpg")) returned 0 [0143.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245654777555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245654777555b315d.jpg")) returned 0x2020 [0143.167] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 0x325098 [0143.167] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 0 [0143.167] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0143.167] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg")) returned 1 [0143.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg")) returned 0xffffffff [0143.168] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 1 [0143.168] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0143.168] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.168] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0143.168] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0143.169] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0143.169] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.169] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af6c) returned 0x10ab [0143.169] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0143.169] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0143.170] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245655567305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245655567305b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0143.170] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7be [0143.170] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0143.171] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0143.259] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7be, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7be, lpOverlapped=0x0) returned 1 [0143.260] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7c0, lpOverlapped=0x0) returned 1 [0143.261] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.284] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.304] CloseHandle (hObject=0x110) returned 1 [0143.304] CloseHandle (hObject=0x10c) returned 1 [0143.305] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245655567305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245655567305b315d.jpg")) returned 0 [0143.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245655567305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245655567305b315d.jpg")) returned 0x2020 [0143.305] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 0x325098 [0143.306] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 0 [0143.306] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0143.306] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg")) returned 1 [0143.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg")) returned 0xffffffff [0143.307] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 1 [0143.309] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0143.309] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.309] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0143.309] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0143.309] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0143.309] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.309] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0fc) returned 0x10ab [0143.309] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0143.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0143.310] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245655A6E725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245655a6e725b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0143.310] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2a [0143.310] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0143.311] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0143.409] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3a2a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3a2a, lpOverlapped=0x0) returned 1 [0143.411] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3a30, lpOverlapped=0x0) returned 1 [0143.412] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.435] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.446] CloseHandle (hObject=0x10c) returned 1 [0143.446] CloseHandle (hObject=0x110) returned 1 [0143.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245655A6E725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245655a6e725b315d.jpg")) returned 0 [0143.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245655A6E725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245655a6e725b315d.jpg")) returned 0x2020 [0143.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 0x325098 [0143.447] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 0 [0143.447] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0143.447] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg")) returned 1 [0143.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg")) returned 0xffffffff [0143.448] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 1 [0143.448] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0143.448] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.448] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0143.448] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0143.448] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.448] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9dc) returned 0x10ab [0143.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0143.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424566354C715B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424566354c715b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0143.465] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f76 [0143.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0143.466] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0143.546] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2f76, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2f76, lpOverlapped=0x0) returned 1 [0143.548] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2f80, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2f80, lpOverlapped=0x0) returned 1 [0143.549] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.571] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.596] CloseHandle (hObject=0x110) returned 1 [0143.596] CloseHandle (hObject=0x10c) returned 1 [0143.596] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424566354C715B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424566354c715b315d.jpg")) returned 0 [0143.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424566354C715B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424566354c715b315d.jpg")) returned 0x2020 [0143.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 0x325098 [0143.597] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 0 [0143.597] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0143.597] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg")) returned 1 [0143.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg")) returned 0xffffffff [0143.598] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1 [0143.598] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0143.598] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.599] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0143.599] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0143.599] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.599] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac50) returned 0x10ab [0143.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0143.600] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245667774555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245667774555b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0143.600] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x786 [0143.600] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0143.601] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0143.690] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x786, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x786, lpOverlapped=0x0) returned 1 [0143.692] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x790, lpOverlapped=0x0) returned 1 [0143.693] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.716] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.727] CloseHandle (hObject=0x10c) returned 1 [0143.727] CloseHandle (hObject=0x110) returned 1 [0143.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245667774555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245667774555b315d.jpg")) returned 0 [0143.728] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245667774555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245667774555b315d.jpg")) returned 0x2020 [0143.728] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0x325098 [0143.728] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0 [0143.728] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0143.728] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg")) returned 1 [0143.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg")) returned 0xffffffff [0143.729] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 1 [0143.729] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0143.729] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.729] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0143.729] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0143.730] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0143.730] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.730] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0143.730] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0143.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0143.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245667A53645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245667a53645b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0143.732] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa07 [0143.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0143.732] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0143.821] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa07, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xa07, lpOverlapped=0x0) returned 1 [0143.823] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xa10, lpOverlapped=0x0) returned 1 [0143.824] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.847] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.858] CloseHandle (hObject=0x110) returned 1 [0143.858] CloseHandle (hObject=0x10c) returned 1 [0143.859] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245667A53645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245667a53645b315d.jpg")) returned 0 [0143.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245667A53645B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245667a53645b315d.jpg")) returned 0x2020 [0143.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 0x325098 [0143.860] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 0 [0143.860] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0143.860] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg")) returned 1 [0143.861] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg")) returned 0xffffffff [0143.861] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 1 [0143.861] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0143.861] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.861] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0143.861] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0143.862] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0143.862] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.862] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0143.862] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0143.862] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0143.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245674375515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245674375515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0143.863] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1998 [0143.863] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0143.864] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0143.954] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1998, lpOverlapped=0x0) returned 1 [0143.956] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x19a0, lpOverlapped=0x0) returned 1 [0143.957] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.979] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.990] CloseHandle (hObject=0x10c) returned 1 [0143.990] CloseHandle (hObject=0x110) returned 1 [0143.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245674375515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245674375515b315d.jpg")) returned 0 [0143.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245674375515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245674375515b315d.jpg")) returned 0x2020 [0143.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 0x325098 [0143.992] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 0 [0143.992] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0143.992] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg")) returned 1 [0143.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg")) returned 0xffffffff [0143.993] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 1 [0143.993] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0143.993] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.993] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0143.993] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0143.993] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0143.993] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0143.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0143.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567487A425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567487a425b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0143.994] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a65 [0143.994] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0143.994] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0144.072] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a65, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1a65, lpOverlapped=0x0) returned 1 [0144.076] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1a70, lpOverlapped=0x0) returned 1 [0144.078] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.101] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.112] CloseHandle (hObject=0x110) returned 1 [0144.112] CloseHandle (hObject=0x10c) returned 1 [0144.112] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567487A425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567487a425b315d.jpg")) returned 0 [0144.114] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567487A425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567487a425b315d.jpg")) returned 0x2020 [0144.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 0x325098 [0144.114] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 0 [0144.114] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0144.114] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg")) returned 1 [0144.115] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg")) returned 0xffffffff [0144.115] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 1 [0144.116] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0144.116] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.116] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0144.116] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0144.117] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0144.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af6c) returned 0x10ab [0144.117] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0144.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567496C325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567496c325b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0144.118] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a45 [0144.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0144.118] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0144.207] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5a45, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x5a45, lpOverlapped=0x0) returned 1 [0144.209] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5a50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5a50, lpOverlapped=0x0) returned 1 [0144.210] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.233] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.244] CloseHandle (hObject=0x10c) returned 1 [0144.245] CloseHandle (hObject=0x110) returned 1 [0144.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567496C325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567496c325b315d.jpg")) returned 0 [0144.245] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567496C325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567496c325b315d.jpg")) returned 0x2020 [0144.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 0x325098 [0144.246] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 0 [0144.246] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0144.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg")) returned 1 [0144.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg")) returned 0xffffffff [0144.247] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 1 [0144.247] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0144.247] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.247] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0144.247] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0144.248] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0144.248] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.248] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0fc) returned 0x10ab [0144.248] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0144.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567496C325B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567496c325b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0144.249] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x388f [0144.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0144.249] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0144.349] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x388f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x388f, lpOverlapped=0x0) returned 1 [0144.351] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3890, lpOverlapped=0x0) returned 1 [0144.352] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.375] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.398] CloseHandle (hObject=0x110) returned 1 [0144.398] CloseHandle (hObject=0x10c) returned 1 [0144.398] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567496C325B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567496c325b325d.jpg")) returned 0 [0144.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42424567496C325B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42424567496c325b325d.jpg")) returned 0x2020 [0144.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 0x325098 [0144.399] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 0 [0144.399] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0144.399] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg")) returned 1 [0144.400] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg")) returned 0xffffffff [0144.400] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1 [0144.400] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0144.400] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.400] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0144.400] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0144.400] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.400] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9dc) returned 0x10ab [0144.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0144.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242456749794C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242456749794c5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0144.401] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e97 [0144.402] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0144.402] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0144.481] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e97, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1e97, lpOverlapped=0x0) returned 1 [0144.483] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1ea0, lpOverlapped=0x0) returned 1 [0144.484] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.507] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.518] CloseHandle (hObject=0x10c) returned 1 [0144.518] CloseHandle (hObject=0x110) returned 1 [0144.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242456749794C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242456749794c5b315d.jpg")) returned 0 [0144.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\4242456749794C5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\4242456749794c5b315d.jpg")) returned 0x2020 [0144.519] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0x325098 [0144.519] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0 [0144.519] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0144.519] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg")) returned 1 [0144.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg")) returned 0xffffffff [0144.520] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 1 [0144.521] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0144.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0144.521] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0144.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac50) returned 0x10ab [0144.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0144.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245676B59365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245676b59365b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0144.522] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23bf [0144.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0144.522] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0144.620] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x23bf, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x23bf, lpOverlapped=0x0) returned 1 [0144.622] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x23c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x23c0, lpOverlapped=0x0) returned 1 [0144.623] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.646] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.657] CloseHandle (hObject=0x110) returned 1 [0144.657] CloseHandle (hObject=0x10c) returned 1 [0144.658] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245676B59365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245676b59365b315d.jpg")) returned 0 [0144.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245676B59365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245676b59365b315d.jpg")) returned 0x2020 [0144.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 0x325098 [0144.659] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 0 [0144.659] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0144.659] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg")) returned 1 [0144.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg")) returned 0xffffffff [0144.660] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 1 [0144.660] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0144.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0144.660] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0144.660] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0144.661] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.661] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0144.661] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0144.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245674C7A565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245674c7a565b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0144.662] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8df [0144.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0144.662] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0144.750] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8df, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x8df, lpOverlapped=0x0) returned 1 [0144.751] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8e0, lpOverlapped=0x0) returned 1 [0144.752] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.775] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.786] CloseHandle (hObject=0x10c) returned 1 [0144.786] CloseHandle (hObject=0x110) returned 1 [0144.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245674C7A565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245674c7a565b315d.jpg")) returned 0 [0144.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245674C7A565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245674c7a565b315d.jpg")) returned 0x2020 [0144.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 0x325098 [0144.787] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 0 [0144.788] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0144.788] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg")) returned 1 [0144.788] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg")) returned 0xffffffff [0144.789] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 1 [0144.789] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0144.789] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.789] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0144.789] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0144.789] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0144.789] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.789] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0144.789] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.790] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0144.791] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675572695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675572695b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0144.791] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b8d [0144.792] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0144.792] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0144.866] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b8d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2b8d, lpOverlapped=0x0) returned 1 [0144.868] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2b90, lpOverlapped=0x0) returned 1 [0144.869] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.892] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.903] CloseHandle (hObject=0x110) returned 1 [0144.903] CloseHandle (hObject=0x10c) returned 1 [0144.903] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675572695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675572695b315d.jpg")) returned 0 [0144.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675572695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675572695b315d.jpg")) returned 0x2020 [0144.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 0x325098 [0144.904] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 0 [0144.904] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0144.904] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg")) returned 1 [0144.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg")) returned 0xffffffff [0144.905] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 1 [0144.906] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0144.906] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.906] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0144.906] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0144.906] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0144.906] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0144.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0144.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675842765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675842765b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0144.907] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x201f [0144.907] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0144.907] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0145.002] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x201f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x201f, lpOverlapped=0x0) returned 1 [0145.003] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2020, lpOverlapped=0x0) returned 1 [0145.005] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.029] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.043] CloseHandle (hObject=0x10c) returned 1 [0145.043] CloseHandle (hObject=0x110) returned 1 [0145.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675842765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675842765b315d.jpg")) returned 0 [0145.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675842765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675842765b315d.jpg")) returned 0x2020 [0145.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 0x325098 [0145.044] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 0 [0145.044] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0145.045] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg")) returned 1 [0145.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg")) returned 0xffffffff [0145.046] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 1 [0145.046] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0145.046] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.046] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0145.046] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0145.046] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0145.046] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.046] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af6c) returned 0x10ab [0145.047] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0145.048] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675A4D455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675a4d455b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0145.048] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e9 [0145.048] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0145.049] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0145.139] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6e9, lpOverlapped=0x0) returned 1 [0145.140] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6f0, lpOverlapped=0x0) returned 1 [0145.141] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.175] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.186] CloseHandle (hObject=0x110) returned 1 [0145.186] CloseHandle (hObject=0x10c) returned 1 [0145.187] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675A4D455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675a4d455b315d.jpg")) returned 0 [0145.188] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424245675A4D455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424245675a4d455b315d.jpg")) returned 0x2020 [0145.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 0x325098 [0145.189] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 0 [0145.189] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0145.189] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg")) returned 1 [0145.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg")) returned 0xffffffff [0145.191] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 1 [0145.191] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0145.191] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.191] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0145.191] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0145.192] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0145.192] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.192] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0fc) returned 0x10ab [0145.192] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0145.193] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424267686656795B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424267686656795b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0145.194] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dc [0145.194] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0145.194] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0145.286] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1dc, lpOverlapped=0x0) returned 1 [0145.288] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1e0, lpOverlapped=0x0) returned 1 [0145.290] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.313] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.334] CloseHandle (hObject=0x10c) returned 1 [0145.334] CloseHandle (hObject=0x110) returned 1 [0145.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424267686656795B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424267686656795b315d.png")) returned 0 [0145.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\424267686656795B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\424267686656795b315d.png")) returned 0x2020 [0145.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 0x325098 [0145.335] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 0 [0145.335] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0145.335] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png")) returned 1 [0145.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png")) returned 0xffffffff [0145.336] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 1 [0145.337] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0145.337] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.337] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0145.337] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0145.337] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.337] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9dc) returned 0x10ab [0145.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0145.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42426B7755725B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42426b7755725b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0145.338] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1af [0145.338] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0145.338] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0145.435] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1af, lpOverlapped=0x0) returned 1 [0145.441] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1b0, lpOverlapped=0x0) returned 1 [0145.442] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.465] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.476] CloseHandle (hObject=0x110) returned 1 [0145.476] CloseHandle (hObject=0x10c) returned 1 [0145.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42426B7755725B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42426b7755725b315d.png")) returned 0 [0145.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42426B7755725B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42426b7755725b315d.png")) returned 0x2020 [0145.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 0x325098 [0145.478] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 0 [0145.478] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0145.478] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png")) returned 1 [0145.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png")) returned 0xffffffff [0145.479] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 1 [0145.480] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0145.480] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.480] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0145.480] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0145.480] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.480] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae28) returned 0x10ab [0145.480] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0145.480] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42426C425630555B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42426c425630555b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0145.481] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23b [0145.481] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0145.481] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0145.573] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x23b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x23b, lpOverlapped=0x0) returned 1 [0145.574] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x240, lpOverlapped=0x0) returned 1 [0145.575] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.599] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.637] CloseHandle (hObject=0x10c) returned 1 [0145.637] CloseHandle (hObject=0x110) returned 1 [0145.637] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42426C425630555B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42426c425630555b315d.png")) returned 0 [0145.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42426C425630555B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42426c425630555b315d.png")) returned 0x2020 [0145.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 0x325098 [0145.638] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 0 [0145.638] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0145.638] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png")) returned 1 [0145.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png")) returned 0xffffffff [0145.639] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 1 [0145.640] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0145.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0145.640] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0145.640] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0145.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0145.640] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0145.641] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42427A685757455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42427a685757455b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0145.641] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3376 [0145.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0145.642] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0145.715] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3376, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3376, lpOverlapped=0x0) returned 1 [0145.722] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3380, lpOverlapped=0x0) returned 1 [0145.723] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.746] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.757] CloseHandle (hObject=0x110) returned 1 [0145.757] CloseHandle (hObject=0x10c) returned 1 [0145.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42427A685757455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42427a685757455b315d.jpg")) returned 0 [0145.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\42427A685757455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\42427a685757455b315d.jpg")) returned 0x2020 [0145.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 0x325098 [0145.758] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 0 [0145.758] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0145.758] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg")) returned 1 [0145.763] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg")) returned 0xffffffff [0145.763] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 1 [0145.763] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0145.763] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0145.763] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0145.764] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b09c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0145.764] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.764] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b09c) returned 0x10ab [0145.764] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0145.765] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62656E65666974732D325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62656e65666974732d325b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0145.766] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c06 [0145.766] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0145.766] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0145.863] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13c06, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x13c06, lpOverlapped=0x0) returned 1 [0145.867] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13c10, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x13c10, lpOverlapped=0x0) returned 1 [0145.869] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.892] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.904] CloseHandle (hObject=0x10c) returned 1 [0145.904] CloseHandle (hObject=0x110) returned 1 [0145.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62656E65666974732D325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62656e65666974732d325b315d.jpg")) returned 0 [0145.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62656E65666974732D325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62656e65666974732d325b315d.jpg")) returned 0x2020 [0145.905] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 0x325098 [0145.905] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 0 [0145.905] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0145.905] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg")) returned 1 [0145.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg")) returned 0xffffffff [0145.906] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1 [0145.907] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0145.907] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.907] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0145.907] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0145.907] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b054, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0145.907] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0145.907] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b054) returned 0x10ab [0145.908] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0145.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62656E65666974732D345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62656e65666974732d345b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0145.908] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144cd [0145.909] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0145.909] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0146.000] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x144cd, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x144cd, lpOverlapped=0x0) returned 1 [0146.004] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x144d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x144d0, lpOverlapped=0x0) returned 1 [0146.006] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.029] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.042] CloseHandle (hObject=0x110) returned 1 [0146.042] CloseHandle (hObject=0x10c) returned 1 [0146.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62656E65666974732D345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62656e65666974732d345b315d.jpg")) returned 0 [0146.043] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62656E65666974732D345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62656e65666974732d345b315d.jpg")) returned 0x2020 [0146.043] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0x325098 [0146.043] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0 [0146.044] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0146.044] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg")) returned 1 [0146.045] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg")) returned 0xffffffff [0146.045] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 1 [0146.045] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.045] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.045] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.046] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0146.046] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b054, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.046] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.046] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b054) returned 0x10ab [0146.046] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0146.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\626F6F7473747261705B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\626f6f7473747261705b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0146.047] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f15 [0146.047] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0146.047] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0146.137] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6f15, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6f15, lpOverlapped=0x0) returned 1 [0146.152] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f20, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6f20, lpOverlapped=0x0) returned 1 [0146.156] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.179] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.193] CloseHandle (hObject=0x10c) returned 1 [0146.193] CloseHandle (hObject=0x110) returned 1 [0146.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\626F6F7473747261705B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\626f6f7473747261705b315d.js")) returned 0 [0146.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\626F6F7473747261705B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\626f6f7473747261705b315d.js")) returned 0x2020 [0146.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 0x325098 [0146.198] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 0 [0146.198] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0146.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js")) returned 1 [0146.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js")) returned 0xffffffff [0146.200] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 1 [0146.203] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.203] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.205] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.205] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad18, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.205] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.205] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad18) returned 0x10ab [0146.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0146.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62726F777365725B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62726f777365725b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0146.207] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf6 [0146.208] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0146.208] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0146.283] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaf6, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xaf6, lpOverlapped=0x0) returned 1 [0146.285] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb00, lpOverlapped=0x0) returned 1 [0146.286] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.309] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.320] CloseHandle (hObject=0x110) returned 1 [0146.320] CloseHandle (hObject=0x10c) returned 1 [0146.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62726F777365725B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62726f777365725b315d.htm")) returned 0 [0146.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62726F777365725B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62726f777365725b315d.htm")) returned 0x2020 [0146.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 0x325098 [0146.321] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 0 [0146.322] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0146.322] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm")) returned 1 [0146.323] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm")) returned 0xffffffff [0146.323] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 1 [0146.323] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.323] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.323] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.323] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0146.323] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.323] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.323] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0146.324] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0146.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62732D6A736465705B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62732d6a736465705b315d.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0146.334] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4dd8 [0146.334] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0146.334] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0146.444] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4dd8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x4dd8, lpOverlapped=0x0) returned 1 [0146.449] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x4de0, lpOverlapped=0x0) returned 1 [0146.450] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.480] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.491] CloseHandle (hObject=0x10c) returned 1 [0146.491] CloseHandle (hObject=0x110) returned 1 [0146.493] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62732D6A736465705B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62732d6a736465705b315d.css")) returned 0 [0146.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\62732D6A736465705B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\62732d6a736465705b315d.css")) returned 0x2020 [0146.494] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 0x325098 [0146.494] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 0 [0146.494] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0146.494] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css")) returned 1 [0146.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css")) returned 0xffffffff [0146.495] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0146.496] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.496] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.496] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.496] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa24, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.496] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.496] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa24) returned 0x10ab [0146.496] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0146.496] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.496] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.496] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.496] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.496] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.497] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab00) returned 0x10ab [0146.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0146.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\636F6C6C6563745B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\636f6c6c6563745b315d.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0146.498] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b [0146.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0146.498] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0146.593] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2b, lpOverlapped=0x0) returned 1 [0146.594] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x30, lpOverlapped=0x0) returned 1 [0146.595] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.618] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.629] CloseHandle (hObject=0x110) returned 1 [0146.629] CloseHandle (hObject=0x10c) returned 1 [0146.629] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\636F6C6C6563745B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\636f6c6c6563745b315d.gif")) returned 0 [0146.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\636F6C6C6563745B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\636f6c6c6563745b315d.gif")) returned 0x2020 [0146.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 0x325098 [0146.630] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 0 [0146.630] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0146.630] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif")) returned 1 [0146.631] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif")) returned 0xffffffff [0146.631] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 1 [0146.632] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.632] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.632] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.632] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.632] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.632] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad8c) returned 0x10ab [0146.632] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0146.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\636F72655B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\636f72655b315d.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0146.634] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29349 [0146.634] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0146.634] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0146.723] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29349, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x29349, lpOverlapped=0x0) returned 1 [0146.737] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x29350, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x29350, lpOverlapped=0x0) returned 1 [0146.741] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.764] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.775] CloseHandle (hObject=0x10c) returned 1 [0146.775] CloseHandle (hObject=0x110) returned 1 [0146.775] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\636F72655B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\636f72655b315d.css")) returned 0 [0146.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\636F72655B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\636f72655b315d.css")) returned 0x2020 [0146.776] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 0x325098 [0146.776] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 0 [0146.776] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0146.776] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css")) returned 1 [0146.779] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css")) returned 0xffffffff [0146.779] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.779] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.779] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.779] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.779] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0146.779] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b098, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.779] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.780] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b098) returned 0x10ab [0146.780] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0146.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0146.781] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0146.781] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0146.781] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0146.856] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x43, lpOverlapped=0x0) returned 1 [0146.857] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x50, lpOverlapped=0x0) returned 1 [0146.858] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.880] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.892] CloseHandle (hObject=0x110) returned 1 [0146.892] CloseHandle (hObject=0x10c) returned 1 [0146.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6465736b746f70.ini")) returned 0 [0146.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6465736b746f70.ini")) returned 0x2020 [0146.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325098 [0146.893] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0146.893] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0146.893] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini")) returned 1 [0146.894] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini")) returned 0xffffffff [0146.894] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 1 [0146.894] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.894] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.894] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.894] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0146.895] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b078, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.895] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.895] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b078) returned 0x10ab [0146.895] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.895] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 1 [0146.895] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0146.895] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.895] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0146.895] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0146.896] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0146.896] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0146.896] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afb4) returned 0x10ab [0146.896] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0146.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6531353165355B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6531353165355b315d.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0146.897] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b [0146.897] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0146.897] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0146.989] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2b, lpOverlapped=0x0) returned 1 [0147.067] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x30, lpOverlapped=0x0) returned 1 [0147.068] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.091] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.102] CloseHandle (hObject=0x10c) returned 1 [0147.102] CloseHandle (hObject=0x110) returned 1 [0147.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6531353165355B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6531353165355b315d.gif")) returned 0 [0147.103] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\6531353165355B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\6531353165355b315d.gif")) returned 0x2020 [0147.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 0x325098 [0147.103] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 0 [0147.103] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0147.104] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif")) returned 1 [0147.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif")) returned 0xffffffff [0147.105] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 1 [0147.105] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.105] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.105] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.105] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0147.105] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.105] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.105] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0147.105] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0147.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\65342D3139303936332D39316364666263315B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\65342d3139303936332d39316364666263315b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0147.107] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24e29 [0147.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0147.107] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0147.202] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x24e29, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x24e29, lpOverlapped=0x0) returned 1 [0147.209] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x24e30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x24e30, lpOverlapped=0x0) returned 1 [0147.212] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.235] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.246] CloseHandle (hObject=0x110) returned 1 [0147.247] CloseHandle (hObject=0x10c) returned 1 [0147.247] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\65342D3139303936332D39316364666263315B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\65342d3139303936332d39316364666263315b315d.txt")) returned 0 [0147.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\65342D3139303936332D39316364666263315B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\65342d3139303936332d39316364666263315b315d.txt")) returned 0x2020 [0147.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 0x325098 [0147.248] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 0 [0147.248] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0147.248] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt")) returned 1 [0147.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt")) returned 0xffffffff [0147.250] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0147.250] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.250] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.250] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.250] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.250] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.250] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae6c) returned 0x10ab [0147.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0147.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\65756C615F746578745B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\65756c615f746578745b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0147.252] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8f5 [0147.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0147.252] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0147.342] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf8f5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xf8f5, lpOverlapped=0x0) returned 1 [0147.354] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf900, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xf900, lpOverlapped=0x0) returned 1 [0147.356] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.379] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.406] CloseHandle (hObject=0x10c) returned 1 [0147.406] CloseHandle (hObject=0x110) returned 1 [0147.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\65756C615F746578745B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\65756c615f746578745b315d.htm")) returned 0 [0147.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\65756C615F746578745B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\65756c615f746578745b315d.htm")) returned 0x2020 [0147.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 0x325098 [0147.407] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 0 [0147.407] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0147.407] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm")) returned 1 [0147.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm")) returned 0xffffffff [0147.408] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 1 [0147.409] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.409] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.409] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.409] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0147.409] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.409] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.409] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a0) returned 0x10ab [0147.409] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.409] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0147.410] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\665B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\665b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0147.411] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34ce [0147.411] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0147.411] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0147.485] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x34ce, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x34ce, lpOverlapped=0x0) returned 1 [0147.487] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x34d0, lpOverlapped=0x0) returned 1 [0147.488] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.511] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.522] CloseHandle (hObject=0x110) returned 1 [0147.522] CloseHandle (hObject=0x10c) returned 1 [0147.522] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\665B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\665b315d.txt")) returned 0 [0147.523] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\665B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\665b315d.txt")) returned 0x2020 [0147.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 0x325098 [0147.523] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 0 [0147.523] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0147.523] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt")) returned 1 [0147.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt")) returned 0xffffffff [0147.525] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1254, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0147.525] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.525] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0147.525] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0147.526] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.526] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 1 [0147.526] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.526] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.526] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.526] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0147.526] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.526] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.526] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0147.526] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0147.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\676F6F676C655F706C75735F313664705B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\676f6f676c655f706c75735f313664705b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0147.534] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a6 [0147.534] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0147.534] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0147.660] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6a6, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6a6, lpOverlapped=0x0) returned 1 [0147.661] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6b0, lpOverlapped=0x0) returned 1 [0147.663] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.685] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.697] CloseHandle (hObject=0x10c) returned 1 [0147.697] CloseHandle (hObject=0x110) returned 1 [0147.697] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\676F6F676C655F706C75735F313664705B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\676f6f676c655f706c75735f313664705b315d.png")) returned 0 [0147.698] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\676F6F676C655F706C75735F313664705B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\676f6f676c655f706c75735f313664705b315d.png")) returned 0x2020 [0147.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 0x325098 [0147.698] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 0 [0147.698] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0147.698] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png")) returned 1 [0147.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png")) returned 0xffffffff [0147.700] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 1 [0147.700] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.700] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.700] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.700] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad2c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.700] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.700] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad2c) returned 0x10ab [0147.700] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0147.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\696E6465785B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\696e6465785b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0147.701] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6c8 [0147.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0147.702] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0147.781] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb6c8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xb6c8, lpOverlapped=0x0) returned 1 [0147.783] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb6d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb6d0, lpOverlapped=0x0) returned 1 [0147.785] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.808] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.819] CloseHandle (hObject=0x110) returned 1 [0147.819] CloseHandle (hObject=0x10c) returned 1 [0147.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\696E6465785B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\696e6465785b315d.htm")) returned 0 [0147.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\696E6465785B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\696e6465785b315d.htm")) returned 0x2020 [0147.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 0x325098 [0147.820] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 0 [0147.821] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0147.821] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm")) returned 1 [0147.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm")) returned 0xffffffff [0147.822] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 1 [0147.822] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.822] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.822] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.822] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0147.824] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0c8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.824] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.824] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0c8) returned 0x10ab [0147.824] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0147.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7072696E745B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7072696e745b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0147.825] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2 [0147.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0147.825] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0147.914] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xa2, lpOverlapped=0x0) returned 1 [0147.923] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb0, lpOverlapped=0x0) returned 1 [0147.925] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.948] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.959] CloseHandle (hObject=0x10c) returned 1 [0147.960] CloseHandle (hObject=0x110) returned 1 [0147.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7072696E745B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7072696e745b315d.txt")) returned 0 [0147.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7072696E745B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7072696e745b315d.txt")) returned 0x2020 [0147.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 0x325098 [0147.961] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 0 [0147.962] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0147.962] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt")) returned 1 [0147.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt")) returned 0xffffffff [0147.963] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f697b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44f697b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44f8f910, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x15429, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="Standard[1]", cAlternateFileName="STANDA~1")) returned 1 [0147.964] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.964] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa2c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa2c) returned 0x10ab [0147.964] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1 [0147.964] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0147.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0147.964] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab38, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0147.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0147.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab38) returned 0x10ab [0147.964] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0147.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7465636A736C6F675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7465636a736c6f675b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0147.966] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67 [0147.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0147.966] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0148.059] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x67, lpOverlapped=0x0) returned 1 [0148.063] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x70, lpOverlapped=0x0) returned 1 [0148.064] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.086] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.097] CloseHandle (hObject=0x110) returned 1 [0148.098] CloseHandle (hObject=0x10c) returned 1 [0148.098] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7465636A736C6F675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7465636a736c6f675b315d.png")) returned 0 [0148.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7465636A736C6F675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7465636a736c6f675b315d.png")) returned 0x2020 [0148.099] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0x325098 [0148.099] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0 [0148.099] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0148.099] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png")) returned 1 [0148.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png")) returned 0xffffffff [0148.100] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 1 [0148.101] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.101] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.101] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.101] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae14, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.101] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.101] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae14) returned 0x10ab [0148.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0148.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7568662D6D61696E2E7661722E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7568662d6d61696e2e7661722e6d696e5b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0148.102] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102ea [0148.102] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0148.102] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0148.191] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x102ea, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x102ea, lpOverlapped=0x0) returned 1 [0148.195] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x102f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x102f0, lpOverlapped=0x0) returned 1 [0148.197] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.220] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.231] CloseHandle (hObject=0x10c) returned 1 [0148.231] CloseHandle (hObject=0x110) returned 1 [0148.231] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7568662D6D61696E2E7661722E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7568662d6d61696e2e7661722e6d696e5b315d.js")) returned 0 [0148.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\7568662D6D61696E2E7661722E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\7568662d6d61696e2e7661722e6d696e5b315d.js")) returned 0x2020 [0148.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 0x325098 [0148.232] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 0 [0148.232] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0148.232] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js")) returned 1 [0148.234] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js")) returned 0xffffffff [0148.234] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2dd5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0148.234] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.234] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0148.235] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.235] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.235] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0148.235] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.235] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="v2[2]", cAlternateFileName="V2_2_~1")) returned 1 [0148.235] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.235] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.235] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.235] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0148.235] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.235] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.236] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0148.236] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.236] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe751ef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe751ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe751ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2fa8, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="v2[3]", cAlternateFileName="V2_3_~1")) returned 1 [0148.236] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.236] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.236] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.236] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0148.236] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.236] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.236] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0148.237] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.237] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 1 [0148.237] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.237] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.237] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.237] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0148.237] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.237] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.237] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0148.237] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.238] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 0 [0148.238] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0148.238] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x696d2e72, dwReserved1=0x5d315b6e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0148.238] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.238] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.238] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.238] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0148.238] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.238] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.238] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0148.238] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0148.240] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0148.242] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0148.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0148.242] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0148.316] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0148.317] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0148.318] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.346] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.358] CloseHandle (hObject=0x108) returned 1 [0148.358] CloseHandle (hObject=0x110) returned 1 [0148.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\6465736b746f70.ini")) returned 0 [0148.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\6465736b746f70.ini")) returned 0x2020 [0148.359] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325058 [0148.359] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0148.359] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0148.359] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini")) returned 1 [0148.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini")) returned 0xffffffff [0148.360] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1 [0148.360] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe600e4, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0148.378] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe600e4, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0148.379] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0xe600e4, dwReserved1=0x31e3e0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 1 [0148.379] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.379] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.379] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.379] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0148.404] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b098, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.404] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.404] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b098) returned 0x10ab [0148.404] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0148.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\31393631393536395B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\31393631393536395b315d.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0148.413] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa756 [0148.413] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0148.414] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0148.488] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa756, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xa756, lpOverlapped=0x0) returned 1 [0148.491] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xa760, lpOverlapped=0x0) returned 1 [0148.493] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.516] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.527] CloseHandle (hObject=0x108) returned 1 [0148.527] CloseHandle (hObject=0x10c) returned 1 [0148.528] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\31393631393536395B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\31393631393536395b315d.gif")) returned 0 [0148.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\31393631393536395B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\31393631393536395b315d.gif")) returned 0x2020 [0148.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 0x325098 [0148.529] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 0 [0148.529] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0148.529] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif")) returned 1 [0148.530] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif")) returned 0xffffffff [0148.530] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 1 [0148.531] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.531] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.531] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.531] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.531] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.531] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9fc) returned 0x10ab [0148.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0148.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\373936323136313038375B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\373936323136313038375b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0148.537] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x461fe [0148.537] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0148.538] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0148.651] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x461fe, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x461fe, lpOverlapped=0x0) returned 1 [0148.659] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x46200, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x46200, lpOverlapped=0x0) returned 1 [0148.665] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.687] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.701] CloseHandle (hObject=0x10c) returned 1 [0148.701] CloseHandle (hObject=0x108) returned 1 [0148.701] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\373936323136313038375B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\373936323136313038375b315d.js")) returned 0 [0148.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\373936323136313038375B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\373936323136313038375b315d.js")) returned 0x2020 [0148.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 0x325098 [0148.702] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 0 [0148.702] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0148.702] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js")) returned 1 [0148.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js")) returned 0xffffffff [0148.705] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 1 [0148.705] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.705] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.705] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.705] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae9c) returned 0x10ab [0148.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0148.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414133444748575B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414133444748575b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0148.706] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d [0148.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0148.707] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0148.837] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x14d, lpOverlapped=0x0) returned 1 [0148.840] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x150, lpOverlapped=0x0) returned 1 [0148.841] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.864] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.875] CloseHandle (hObject=0x108) returned 1 [0148.875] CloseHandle (hObject=0x10c) returned 1 [0148.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414133444748575B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414133444748575b315d.png")) returned 0 [0148.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414133444748575B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414133444748575b315d.png")) returned 0x2020 [0148.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 0x325098 [0148.876] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 0 [0148.876] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0148.876] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png")) returned 1 [0148.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png")) returned 0xffffffff [0148.878] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 1 [0148.878] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0148.878] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.878] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0148.878] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0148.879] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0148.879] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0148.879] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0148.879] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0148.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414133653170745B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414133653170745b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0148.881] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197 [0148.881] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0148.881] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0148.983] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x197, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x197, lpOverlapped=0x0) returned 1 [0148.984] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1a0, lpOverlapped=0x0) returned 1 [0148.985] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.008] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.019] CloseHandle (hObject=0x10c) returned 1 [0149.019] CloseHandle (hObject=0x108) returned 1 [0149.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414133653170745B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414133653170745b325d.png")) returned 0 [0149.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414133653170745B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414133653170745b325d.png")) returned 0x2020 [0149.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 0x325098 [0149.021] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 0 [0149.021] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0149.021] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png")) returned 1 [0149.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png")) returned 0xffffffff [0149.022] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 1 [0149.022] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0149.022] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.022] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0149.022] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0149.022] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0149.022] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.023] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0e8) returned 0x10ab [0149.023] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0149.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41413432636B645B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41413432636b645b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0149.024] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c2 [0149.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0149.024] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0149.100] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2c2, lpOverlapped=0x0) returned 1 [0149.102] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d0, lpOverlapped=0x0) returned 1 [0149.103] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.126] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.137] CloseHandle (hObject=0x108) returned 1 [0149.137] CloseHandle (hObject=0x10c) returned 1 [0149.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41413432636B645B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41413432636b645b315d.png")) returned 0 [0149.138] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41413432636B645B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41413432636b645b315d.png")) returned 0x2020 [0149.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 0x325098 [0149.138] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 0 [0149.138] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0149.138] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png")) returned 1 [0149.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png")) returned 0xffffffff [0149.139] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 1 [0149.140] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0149.140] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.140] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0149.140] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0149.140] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.140] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e8) returned 0x10ab [0149.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0149.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414134326559725B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414134326559725b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0149.141] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c2 [0149.141] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0149.141] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0149.238] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2c2, lpOverlapped=0x0) returned 1 [0149.240] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d0, lpOverlapped=0x0) returned 1 [0149.242] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.264] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.275] CloseHandle (hObject=0x10c) returned 1 [0149.275] CloseHandle (hObject=0x108) returned 1 [0149.276] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414134326559725B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414134326559725b315d.png")) returned 0 [0149.276] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414134326559725B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414134326559725b315d.png")) returned 0x2020 [0149.276] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 0x325098 [0149.277] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 0 [0149.277] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0149.277] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png")) returned 1 [0149.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png")) returned 0xffffffff [0149.278] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 1 [0149.278] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0149.278] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.278] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0149.278] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0149.278] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.278] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acc4) returned 0x10ab [0149.278] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0149.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41413631494C705B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41413631494c705b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0149.281] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x204 [0149.281] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0149.281] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0149.393] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x204, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x204, lpOverlapped=0x0) returned 1 [0149.395] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x210, lpOverlapped=0x0) returned 1 [0149.396] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.419] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.430] CloseHandle (hObject=0x108) returned 1 [0149.430] CloseHandle (hObject=0x10c) returned 1 [0149.430] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41413631494C705B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41413631494c705b325d.png")) returned 0 [0149.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41413631494C705B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41413631494c705b325d.png")) returned 0x2020 [0149.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 0x325098 [0149.431] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 0 [0149.431] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0149.431] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png")) returned 1 [0149.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png")) returned 0xffffffff [0149.432] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 1 [0149.432] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0149.432] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.433] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0149.433] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0149.433] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0149.433] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.433] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0149.433] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0149.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414136534E5A365B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414136534e5a365b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0149.434] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ed [0149.434] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0149.434] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0149.512] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2ed, lpOverlapped=0x0) returned 1 [0149.513] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2f0, lpOverlapped=0x0) returned 1 [0149.514] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.538] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.549] CloseHandle (hObject=0x10c) returned 1 [0149.549] CloseHandle (hObject=0x108) returned 1 [0149.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414136534E5A365B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414136534e5a365b315d.png")) returned 0 [0149.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414136534E5A365B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414136534e5a365b315d.png")) returned 0x2020 [0149.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 0x325098 [0149.564] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 0 [0149.565] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0149.565] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png")) returned 1 [0149.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png")) returned 0xffffffff [0149.567] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 1 [0149.570] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0149.570] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.572] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0149.573] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0149.573] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.573] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa58) returned 0x10ab [0149.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0149.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416279696E435B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416279696e435b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0149.576] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fc [0149.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0149.577] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0149.678] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2fc, lpOverlapped=0x0) returned 1 [0149.680] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x300, lpOverlapped=0x0) returned 1 [0149.681] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.703] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.714] CloseHandle (hObject=0x108) returned 1 [0149.714] CloseHandle (hObject=0x10c) returned 1 [0149.714] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416279696E435B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416279696e435b315d.png")) returned 0 [0149.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416279696E435B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416279696e435b315d.png")) returned 0x2020 [0149.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 0x325098 [0149.715] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 0 [0149.715] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0149.715] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png")) returned 1 [0149.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png")) returned 0xffffffff [0149.716] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 1 [0149.716] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0149.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.716] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0149.716] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae1c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0149.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.717] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae1c) returned 0x10ab [0149.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0149.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414169635735575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414169635735575b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0149.717] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x340b [0149.717] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0149.718] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0149.806] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x340b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x340b, lpOverlapped=0x0) returned 1 [0149.808] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3410, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3410, lpOverlapped=0x0) returned 1 [0149.809] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.832] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.843] CloseHandle (hObject=0x10c) returned 1 [0149.843] CloseHandle (hObject=0x108) returned 1 [0149.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414169635735575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414169635735575b315d.jpg")) returned 0 [0149.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\414169635735575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\414169635735575b315d.jpg")) returned 0x2020 [0149.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 0x325098 [0149.844] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 0 [0149.844] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0149.844] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg")) returned 1 [0149.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg")) returned 0xffffffff [0149.845] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 1 [0149.845] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0149.845] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.845] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0149.845] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0149.846] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0149.846] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.846] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0149.846] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0149.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416A30646F515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416a30646f515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0149.847] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a4 [0149.847] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0149.848] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0149.922] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x19a4, lpOverlapped=0x0) returned 1 [0149.923] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x19b0, lpOverlapped=0x0) returned 1 [0149.924] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.947] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.963] CloseHandle (hObject=0x108) returned 1 [0149.963] CloseHandle (hObject=0x10c) returned 1 [0149.964] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416A30646F515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416a30646f515b315d.jpg")) returned 0 [0149.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416A30646F515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416a30646f515b315d.jpg")) returned 0x2020 [0149.964] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 0x325098 [0149.965] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 0 [0149.965] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0149.965] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg")) returned 1 [0149.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg")) returned 0xffffffff [0149.966] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 1 [0149.966] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0149.966] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.966] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0149.966] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0149.967] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b09c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0149.967] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0149.967] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b09c) returned 0x10ab [0149.967] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0149.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416B716849665B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416b716849665b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0149.968] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c [0149.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0149.968] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0150.059] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x35c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x35c, lpOverlapped=0x0) returned 1 [0150.074] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x360, lpOverlapped=0x0) returned 1 [0150.075] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.098] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.109] CloseHandle (hObject=0x10c) returned 1 [0150.109] CloseHandle (hObject=0x108) returned 1 [0150.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416B716849665B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416b716849665b315d.png")) returned 0 [0150.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416B716849665B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416b716849665b315d.png")) returned 0x2020 [0150.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 0x325098 [0150.110] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 0 [0150.110] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0150.110] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png")) returned 1 [0150.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png")) returned 0xffffffff [0150.111] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 1 [0150.111] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.111] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.112] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0150.112] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b07c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.112] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b07c) returned 0x10ab [0150.112] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0150.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0150.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416D6F3039705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416d6f3039705b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0150.113] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x278e [0150.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0150.113] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0150.202] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x278e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x278e, lpOverlapped=0x0) returned 1 [0150.204] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2790, lpOverlapped=0x0) returned 1 [0150.205] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.228] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.239] CloseHandle (hObject=0x108) returned 1 [0150.239] CloseHandle (hObject=0x10c) returned 1 [0150.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416D6F3039705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416d6f3039705b315d.jpg")) returned 0 [0150.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416D6F3039705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416d6f3039705b315d.jpg")) returned 0x2020 [0150.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 0x325098 [0150.246] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 0 [0150.246] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0150.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg")) returned 1 [0150.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg")) returned 0xffffffff [0150.248] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 1 [0150.248] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.248] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.248] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.248] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abfc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.248] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.248] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abfc) returned 0x10ab [0150.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0150.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416D557956325B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416d557956325b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0150.249] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a [0150.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0150.250] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0150.340] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x19a, lpOverlapped=0x0) returned 1 [0150.342] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1a0, lpOverlapped=0x0) returned 1 [0150.343] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.365] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.401] CloseHandle (hObject=0x10c) returned 1 [0150.401] CloseHandle (hObject=0x108) returned 1 [0150.401] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416D557956325B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416d557956325b315d.png")) returned 0 [0150.402] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416D557956325B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416d557956325b315d.png")) returned 0x2020 [0150.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 0x325098 [0150.402] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 0 [0150.402] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0150.402] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png")) returned 1 [0150.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png")) returned 0xffffffff [0150.403] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 1 [0150.404] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.404] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.404] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.404] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0150.404] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afd0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.404] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.404] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afd0) returned 0x10ab [0150.404] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0150.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0150.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416E37674B525B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416e37674b525b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0150.405] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0150.405] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0150.406] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0150.479] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xfe, lpOverlapped=0x0) returned 1 [0150.480] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x100, lpOverlapped=0x0) returned 1 [0150.481] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.504] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.515] CloseHandle (hObject=0x108) returned 1 [0150.515] CloseHandle (hObject=0x10c) returned 1 [0150.515] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416E37674B525B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416e37674b525b315d.png")) returned 0 [0150.516] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\41416E37674B525B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\41416e37674b525b315d.png")) returned 0x2020 [0150.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 0x325098 [0150.516] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 0 [0150.516] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0150.516] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png")) returned 1 [0150.517] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png")) returned 0xffffffff [0150.517] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0150.518] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.518] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.518] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.518] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0150.518] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.518] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.518] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0e8) returned 0x10ab [0150.518] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0150.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0150.519] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6163746976697479693B7372633D323534323131363B747970653D636C69656E3631323B6361743D6368726F6D303B6F72643D313B6E756D3D373831343339343036303231335B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6163746976697479693b7372633d323534323131363b747970653d636c69656e3631323b6361743d6368726f6d303b6f72643d313b6e756d3d373831343339343036303231335b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.519] CloseHandle (hObject=0x10c) returned 1 [0150.519] CloseHandle (hObject=0xffffffff) returned 0 [0150.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6163746976697479693B7372633D323534323131363B747970653D636C69656E3631323B6361743D6368726F6D303B6F72643D313B6E756D3D373831343339343036303231335B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6163746976697479693b7372633d323534323131363b747970653d636c69656e3631323b6361743d6368726f6d303b6f72643d313b6e756d3d373831343339343036303231335b315d.htm")) returned 0 [0150.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6163746976697479693B7372633D323534323131363B747970653D636C69656E3631323B6361743D6368726F6D303B6F72643D313B6E756D3D373831343339343036303231335B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6163746976697479693b7372633d323534323131363b747970653d636c69656e3631323b6361743d6368726f6d303b6f72643d313b6e756d3d373831343339343036303231335b315d.htm")) returned 0xffffffff [0150.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 0x325098 [0150.520] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 0 [0150.520] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0150.520] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi")) returned 0 [0150.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm")) returned 0x2020 [0150.520] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2a0770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2a0770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x0, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0150.520] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.521] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0150.521] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0150.521] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0150.521] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf1f, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="adfserve[1]", cAlternateFileName="ADFSER~1")) returned 1 [0150.521] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.522] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aab8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.522] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.522] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aab8) returned 0x10ab [0150.522] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 1 [0150.522] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.522] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.522] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.522] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.522] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.522] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab74) returned 0x10ab [0150.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0150.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6173745B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6173745b325d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0150.524] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11835 [0150.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0150.524] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0150.616] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11835, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x11835, lpOverlapped=0x0) returned 1 [0150.619] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11840, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x11840, lpOverlapped=0x0) returned 1 [0150.621] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.645] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.656] CloseHandle (hObject=0x10c) returned 1 [0150.656] CloseHandle (hObject=0x108) returned 1 [0150.656] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6173745B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6173745b325d.js")) returned 0 [0150.657] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6173745B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6173745b325d.js")) returned 0x2020 [0150.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 0x325098 [0150.662] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 0 [0150.662] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0150.662] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js")) returned 1 [0150.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js")) returned 0xffffffff [0150.664] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53d7b330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53d7b330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53d7b330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0150.664] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.664] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.664] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.664] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0150.665] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.665] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.665] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0150.665] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0150.665] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 1 [0150.665] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.665] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.665] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.665] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af30, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.665] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.665] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af30) returned 0x10ab [0150.665] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 1 [0150.665] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.665] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.666] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.666] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0150.666] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b004, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.666] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.666] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b004) returned 0x10ab [0150.666] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0150.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0150.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242357A4477585B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242357a4477585b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0150.667] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c0 [0150.667] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0150.667] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0150.756] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2c0, lpOverlapped=0x0) returned 1 [0150.758] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d0, lpOverlapped=0x0) returned 1 [0150.759] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.781] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.793] CloseHandle (hObject=0x108) returned 1 [0150.793] CloseHandle (hObject=0x10c) returned 1 [0150.793] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242357A4477585B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242357a4477585b315d.png")) returned 0 [0150.794] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242357A4477585B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242357a4477585b315d.png")) returned 0x2020 [0150.794] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 0x325098 [0150.794] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 0 [0150.794] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0150.794] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png")) returned 1 [0150.795] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png")) returned 0xffffffff [0150.795] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 1 [0150.795] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.795] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.795] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.795] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0150.796] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.796] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.796] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0150.796] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0150.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0150.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242614B334E6D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242614b334e6d5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0150.797] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x227 [0150.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0150.797] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0150.870] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x227, lpOverlapped=0x0) returned 1 [0150.872] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x230, lpOverlapped=0x0) returned 1 [0150.873] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.895] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.907] CloseHandle (hObject=0x10c) returned 1 [0150.907] CloseHandle (hObject=0x108) returned 1 [0150.907] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242614B334E6D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242614b334e6d5b315d.png")) returned 0 [0150.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242614B334E6D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242614b334e6d5b315d.png")) returned 0x2020 [0150.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 0x325098 [0150.908] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 0 [0150.908] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0150.908] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png")) returned 1 [0150.909] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png")) returned 0xffffffff [0150.909] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 1 [0150.909] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0150.909] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.909] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0150.909] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0150.910] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b004, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0150.910] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0150.910] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b004) returned 0x10ab [0150.910] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0150.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0150.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424C63437A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424c63437a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0150.911] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2143 [0150.911] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0150.911] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0151.007] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2143, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2143, lpOverlapped=0x0) returned 1 [0151.008] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2150, lpOverlapped=0x0) returned 1 [0151.010] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.033] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.045] CloseHandle (hObject=0x108) returned 1 [0151.045] CloseHandle (hObject=0x10c) returned 1 [0151.046] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424C63437A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424c63437a5b315d.jpg")) returned 0 [0151.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424C63437A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424c63437a5b315d.jpg")) returned 0x2020 [0151.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 0x325098 [0151.047] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 0 [0151.047] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0151.047] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg")) returned 1 [0151.048] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg")) returned 0xffffffff [0151.048] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 1 [0151.048] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0151.048] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.048] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0151.049] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0151.049] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b084, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0151.049] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.049] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b084) returned 0x10ab [0151.049] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0151.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0151.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424C647A515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424c647a515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0151.050] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x912 [0151.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0151.051] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0151.142] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x912, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x912, lpOverlapped=0x0) returned 1 [0151.144] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x920, lpOverlapped=0x0) returned 1 [0151.145] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.168] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.179] CloseHandle (hObject=0x10c) returned 1 [0151.179] CloseHandle (hObject=0x108) returned 1 [0151.179] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424C647A515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424c647a515b315d.jpg")) returned 0 [0151.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424C647A515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424c647a515b315d.jpg")) returned 0x2020 [0151.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 0x325098 [0151.180] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 0 [0151.180] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0151.180] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg")) returned 1 [0151.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg")) returned 0xffffffff [0151.181] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1 [0151.182] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0151.182] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.182] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0151.182] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac64, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0151.182] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.182] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac64) returned 0x10ab [0151.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0151.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F316D515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f316d515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0151.183] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e8 [0151.183] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0151.183] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0151.277] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6e8, lpOverlapped=0x0) returned 1 [0151.280] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6f0, lpOverlapped=0x0) returned 1 [0151.282] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.305] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.316] CloseHandle (hObject=0x108) returned 1 [0151.316] CloseHandle (hObject=0x10c) returned 1 [0151.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F316D515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f316d515b315d.jpg")) returned 0 [0151.318] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F316D515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f316d515b315d.jpg")) returned 0x2020 [0151.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0x325098 [0151.318] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0 [0151.318] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0151.318] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg")) returned 1 [0151.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg")) returned 0xffffffff [0151.319] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 1 [0151.320] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0151.320] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.320] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0151.320] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0151.321] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afcc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0151.321] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.321] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afcc) returned 0x10ab [0151.321] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0151.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0151.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F3171425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f3171425b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0151.322] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36d2 [0151.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0151.323] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0151.430] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x36d2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x36d2, lpOverlapped=0x0) returned 1 [0151.432] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x36e0, lpOverlapped=0x0) returned 1 [0151.433] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.456] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.467] CloseHandle (hObject=0x10c) returned 1 [0151.467] CloseHandle (hObject=0x108) returned 1 [0151.468] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F3171425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f3171425b315d.jpg")) returned 0 [0151.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F3171425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f3171425b315d.jpg")) returned 0x2020 [0151.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 0x325098 [0151.469] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 0 [0151.469] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0151.469] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg")) returned 1 [0151.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg")) returned 0xffffffff [0151.470] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 1 [0151.470] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0151.470] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.470] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0151.470] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0151.471] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b04c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0151.471] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.471] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b04c) returned 0x10ab [0151.471] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0151.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0151.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F4941745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f4941745b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0151.474] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x75e [0151.474] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0151.474] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0151.548] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x75e, lpOverlapped=0x0) returned 1 [0151.550] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x760, lpOverlapped=0x0) returned 1 [0151.551] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.574] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.586] CloseHandle (hObject=0x108) returned 1 [0151.586] CloseHandle (hObject=0x10c) returned 1 [0151.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F4941745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f4941745b315d.jpg")) returned 0 [0151.587] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F4941745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f4941745b315d.jpg")) returned 0x2020 [0151.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 0x325098 [0151.587] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 0 [0151.587] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0151.587] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg")) returned 1 [0151.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg")) returned 0xffffffff [0151.588] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 1 [0151.589] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0151.589] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.589] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0151.589] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0151.589] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.589] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa84) returned 0x10ab [0151.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0151.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F6D75685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f6d75685b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0151.590] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6dc [0151.590] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0151.590] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0151.692] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6dc, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6dc, lpOverlapped=0x0) returned 1 [0151.693] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6e0, lpOverlapped=0x0) returned 1 [0151.694] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.717] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.728] CloseHandle (hObject=0x10c) returned 1 [0151.728] CloseHandle (hObject=0x108) returned 1 [0151.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F6D75685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f6d75685b315d.jpg")) returned 0 [0151.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242424F6D75685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242424f6d75685b315d.jpg")) returned 0x2020 [0151.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 0x325098 [0151.729] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 0 [0151.729] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0151.729] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg")) returned 1 [0151.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg")) returned 0xffffffff [0151.730] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 1 [0151.731] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0151.731] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.731] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0151.731] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae64, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0151.731] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.731] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae64) returned 0x10ab [0151.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0151.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242504B354A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242504b354a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0151.732] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9be [0151.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0151.732] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0151.830] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9be, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9be, lpOverlapped=0x0) returned 1 [0151.834] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9c0, lpOverlapped=0x0) returned 1 [0151.836] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.860] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.871] CloseHandle (hObject=0x108) returned 1 [0151.871] CloseHandle (hObject=0x10c) returned 1 [0151.872] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242504B354A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242504b354a5b315d.jpg")) returned 0 [0151.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242504B354A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242504b354a5b315d.jpg")) returned 0x2020 [0151.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 0x325098 [0151.873] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 0 [0151.873] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0151.874] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg")) returned 1 [0151.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg")) returned 0xffffffff [0151.875] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 1 [0151.877] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0151.877] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.877] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0151.877] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0151.878] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0151.878] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0151.878] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0151.878] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0151.878] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0151.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242504D764A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242504d764a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0151.880] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1694 [0151.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0151.881] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0151.971] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1694, lpOverlapped=0x0) returned 1 [0151.973] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x16a0, lpOverlapped=0x0) returned 1 [0151.974] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.997] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.008] CloseHandle (hObject=0x10c) returned 1 [0152.008] CloseHandle (hObject=0x108) returned 1 [0152.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242504D764A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242504d764a5b315d.jpg")) returned 0 [0152.009] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242504D764A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242504d764a5b315d.jpg")) returned 0x2020 [0152.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 0x325098 [0152.009] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 0 [0152.009] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0152.009] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg")) returned 1 [0152.010] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg")) returned 0xffffffff [0152.010] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 1 [0152.010] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0152.010] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.010] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0152.010] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0152.011] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0152.011] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.011] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0152.011] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0152.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0152.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242554C33455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242554c33455b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0152.012] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d [0152.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0152.012] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0152.095] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x85d, lpOverlapped=0x0) returned 1 [0152.325] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x860, lpOverlapped=0x0) returned 1 [0152.326] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.349] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.367] CloseHandle (hObject=0x108) returned 1 [0152.368] CloseHandle (hObject=0x10c) returned 1 [0152.368] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242554C33455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242554c33455b315d.jpg")) returned 0 [0152.369] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242554C33455B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242554c33455b315d.jpg")) returned 0x2020 [0152.369] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 0x325098 [0152.369] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 0 [0152.369] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0152.369] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg")) returned 1 [0152.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg")) returned 0xffffffff [0152.370] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 1 [0152.371] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0152.371] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.371] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0152.371] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0152.371] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b104, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0152.371] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.371] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b104) returned 0x10ab [0152.371] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0152.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0152.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424255716B545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424255716b545b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0152.373] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x878 [0152.373] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0152.373] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0152.435] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x878, lpOverlapped=0x0) returned 1 [0152.441] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x880, lpOverlapped=0x0) returned 1 [0152.442] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.465] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.476] CloseHandle (hObject=0x10c) returned 1 [0152.476] CloseHandle (hObject=0x108) returned 1 [0152.476] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424255716B545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424255716b545b315d.jpg")) returned 0 [0152.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424255716B545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424255716b545b315d.jpg")) returned 0x2020 [0152.477] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 0x325098 [0152.477] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 0 [0152.477] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0152.477] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg")) returned 1 [0152.478] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg")) returned 0xffffffff [0152.478] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 1 [0152.479] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0152.479] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.479] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0152.479] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa04, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0152.479] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.479] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa04) returned 0x10ab [0152.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0152.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424255716B545B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424255716b545b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0152.480] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x878 [0152.480] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0152.480] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0152.515] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x878, lpOverlapped=0x0) returned 1 [0152.524] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x880, lpOverlapped=0x0) returned 1 [0152.525] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.548] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.559] CloseHandle (hObject=0x108) returned 1 [0152.559] CloseHandle (hObject=0x10c) returned 1 [0152.559] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424255716B545B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424255716b545b325d.jpg")) returned 0 [0152.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424255716B545B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424255716b545b325d.jpg")) returned 0x2020 [0152.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 0x325098 [0152.560] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 0 [0152.560] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0152.560] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg")) returned 1 [0152.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg")) returned 0xffffffff [0152.561] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 1 [0152.562] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0152.562] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.562] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0152.562] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adf8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0152.562] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.562] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adf8) returned 0x10ab [0152.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0152.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424258337A305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424258337a305b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0152.566] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77f [0152.566] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0152.567] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0152.602] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x77f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x77f, lpOverlapped=0x0) returned 1 [0152.604] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x780, lpOverlapped=0x0) returned 1 [0152.605] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.629] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.640] CloseHandle (hObject=0x10c) returned 1 [0152.640] CloseHandle (hObject=0x108) returned 1 [0152.640] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424258337A305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424258337a305b315d.jpg")) returned 0 [0152.641] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424258337A305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424258337a305b315d.jpg")) returned 0x2020 [0152.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 0x325098 [0152.641] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 0 [0152.641] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0152.641] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg")) returned 1 [0152.642] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg")) returned 0xffffffff [0152.642] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 1 [0152.642] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0152.642] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.642] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0152.642] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0152.643] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0152.643] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.643] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0152.643] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0152.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0152.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242594557315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242594557315b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0152.644] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22b3 [0152.644] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0152.644] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0152.678] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x22b3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x22b3, lpOverlapped=0x0) returned 1 [0152.699] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x22c0, lpOverlapped=0x0) returned 1 [0152.705] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.728] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.742] CloseHandle (hObject=0x108) returned 1 [0152.742] CloseHandle (hObject=0x10c) returned 1 [0152.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242594557315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242594557315b315d.jpg")) returned 0 [0152.745] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242594557315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242594557315b315d.jpg")) returned 0x2020 [0152.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 0x325098 [0152.746] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 0 [0152.746] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0152.746] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg")) returned 1 [0152.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg")) returned 0xffffffff [0152.747] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1 [0152.750] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0152.750] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.753] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0152.753] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0152.753] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0152.753] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.753] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0152.753] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0152.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0152.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242596645485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242596645485b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0152.755] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19cf [0152.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0152.755] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0152.792] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19cf, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x19cf, lpOverlapped=0x0) returned 1 [0152.794] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x19d0, lpOverlapped=0x0) returned 1 [0152.795] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.817] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.831] CloseHandle (hObject=0x10c) returned 1 [0152.831] CloseHandle (hObject=0x108) returned 1 [0152.831] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242596645485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242596645485b315d.jpg")) returned 0 [0152.832] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424242596645485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424242596645485b315d.jpg")) returned 0x2020 [0152.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0x325098 [0152.832] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0 [0152.832] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0152.832] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg")) returned 1 [0152.833] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg")) returned 0xffffffff [0152.833] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 1 [0152.834] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0152.834] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.834] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0152.834] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0152.834] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0152.834] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.834] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0e8) returned 0x10ab [0152.834] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0152.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0152.836] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242425A3230575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242425a3230575b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0152.836] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ca1 [0152.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0152.837] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0152.872] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2ca1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2ca1, lpOverlapped=0x0) returned 1 [0152.874] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2cb0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2cb0, lpOverlapped=0x0) returned 1 [0152.875] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.897] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.909] CloseHandle (hObject=0x108) returned 1 [0152.909] CloseHandle (hObject=0x10c) returned 1 [0152.909] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242425A3230575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242425a3230575b315d.jpg")) returned 0 [0152.910] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242425A3230575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242425a3230575b315d.jpg")) returned 0x2020 [0152.910] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 0x325098 [0152.910] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 0 [0152.910] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0152.910] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg")) returned 1 [0152.911] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg")) returned 0xffffffff [0152.911] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 1 [0152.911] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0152.911] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.911] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0152.911] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0152.911] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0152.912] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa0c) returned 0x10ab [0152.912] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0152.912] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242427A6178595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242427a6178595b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0152.913] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f37 [0152.913] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0152.913] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0152.963] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f37, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1f37, lpOverlapped=0x0) returned 1 [0152.965] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1f40, lpOverlapped=0x0) returned 1 [0152.966] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.989] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.000] CloseHandle (hObject=0x10c) returned 1 [0153.000] CloseHandle (hObject=0x108) returned 1 [0153.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242427A6178595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242427a6178595b315d.jpg")) returned 0 [0153.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242427A6178595B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242427a6178595b315d.jpg")) returned 0x2020 [0153.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 0x325098 [0153.001] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 0 [0153.001] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0153.001] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg")) returned 1 [0153.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg")) returned 0xffffffff [0153.002] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 1 [0153.002] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0153.003] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.003] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0153.003] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ade0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0153.003] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.003] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ade0) returned 0x10ab [0153.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0153.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242425A7A757A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242425a7a757a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0153.004] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2131 [0153.004] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0153.004] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0153.038] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2131, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2131, lpOverlapped=0x0) returned 1 [0153.046] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2140, lpOverlapped=0x0) returned 1 [0153.048] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.070] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.082] CloseHandle (hObject=0x108) returned 1 [0153.082] CloseHandle (hObject=0x10c) returned 1 [0153.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242425A7A757A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242425a7a757a5b315d.jpg")) returned 0 [0153.083] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242425A7A757A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242425a7a757a5b315d.jpg")) returned 0x2020 [0153.083] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 0x325098 [0153.083] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 0 [0153.083] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0153.083] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg")) returned 1 [0153.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg")) returned 0xffffffff [0153.084] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1 [0153.085] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0153.085] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.085] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0153.085] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0153.085] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0153.085] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.085] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0153.085] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0153.085] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0153.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243303342315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243303342315b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0153.086] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x370a [0153.086] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0153.086] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0153.173] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x370a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x370a, lpOverlapped=0x0) returned 1 [0153.174] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3710, lpOverlapped=0x0) returned 1 [0153.176] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.199] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.210] CloseHandle (hObject=0x10c) returned 1 [0153.210] CloseHandle (hObject=0x108) returned 1 [0153.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243303342315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243303342315b315d.jpg")) returned 0 [0153.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243303342315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243303342315b315d.jpg")) returned 0x2020 [0153.211] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0x325098 [0153.211] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0 [0153.211] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0153.211] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg")) returned 1 [0153.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg")) returned 0xffffffff [0153.212] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1 [0153.212] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0153.212] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.213] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0153.213] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0153.213] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.213] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa84) returned 0x10ab [0153.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0153.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330346F325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330346f325b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0153.214] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22a0 [0153.214] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0153.214] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0153.290] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x22a0, lpOverlapped=0x0) returned 1 [0153.292] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x22b0, lpOverlapped=0x0) returned 1 [0153.293] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.316] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.327] CloseHandle (hObject=0x108) returned 1 [0153.327] CloseHandle (hObject=0x10c) returned 1 [0153.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330346F325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330346f325b315d.jpg")) returned 0 [0153.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330346F325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330346f325b315d.jpg")) returned 0x2020 [0153.328] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0x325098 [0153.328] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0 [0153.328] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0153.328] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg")) returned 1 [0153.329] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg")) returned 0xffffffff [0153.329] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 1 [0153.330] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0153.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0153.330] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0153.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab7c) returned 0x10ab [0153.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0153.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330365A515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330365a515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0153.331] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2036 [0153.331] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0153.331] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0153.458] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2036, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2036, lpOverlapped=0x0) returned 1 [0153.459] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2040, lpOverlapped=0x0) returned 1 [0153.460] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.483] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.494] CloseHandle (hObject=0x10c) returned 1 [0153.494] CloseHandle (hObject=0x108) returned 1 [0153.495] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330365A515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330365a515b315d.jpg")) returned 0 [0153.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330365A515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330365a515b315d.jpg")) returned 0x2020 [0153.496] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 0x325098 [0153.496] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 0 [0153.496] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0153.496] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg")) returned 1 [0153.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg")) returned 0xffffffff [0153.497] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1 [0153.498] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0153.498] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.498] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0153.498] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0153.498] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af80, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0153.498] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.498] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af80) returned 0x10ab [0153.498] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0153.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0153.499] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330414C435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330414c435b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0153.500] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fd [0153.500] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0153.500] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0153.608] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13fd, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x13fd, lpOverlapped=0x0) returned 1 [0153.609] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1400, lpOverlapped=0x0) returned 1 [0153.610] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.633] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.644] CloseHandle (hObject=0x108) returned 1 [0153.645] CloseHandle (hObject=0x10c) returned 1 [0153.645] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330414C435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330414c435b315d.jpg")) returned 0 [0153.645] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424330414C435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424330414c435b315d.jpg")) returned 0x2020 [0153.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0x325098 [0153.646] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0 [0153.646] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0153.646] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg")) returned 1 [0153.647] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg")) returned 0xffffffff [0153.647] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 1 [0153.647] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0153.647] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.647] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0153.647] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0153.648] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0153.648] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.648] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0153.648] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0153.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0153.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242433042695A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242433042695a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0153.649] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x884 [0153.649] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0153.649] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0153.723] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x884, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x884, lpOverlapped=0x0) returned 1 [0153.725] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x890, lpOverlapped=0x0) returned 1 [0153.726] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.749] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.760] CloseHandle (hObject=0x10c) returned 1 [0153.760] CloseHandle (hObject=0x108) returned 1 [0153.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242433042695A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242433042695a5b315d.jpg")) returned 0 [0153.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242433042695A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242433042695a5b315d.jpg")) returned 0x2020 [0153.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 0x325098 [0153.761] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 0 [0153.761] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0153.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg")) returned 1 [0153.762] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg")) returned 0xffffffff [0153.762] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 1 [0153.763] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0153.763] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0153.763] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0153.763] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0153.763] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0153.763] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0153.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0153.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243304658555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243304658555b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0153.764] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34d8 [0153.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0153.765] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0153.854] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x34d8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x34d8, lpOverlapped=0x0) returned 1 [0153.862] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x34e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x34e0, lpOverlapped=0x0) returned 1 [0153.863] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.886] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.897] CloseHandle (hObject=0x108) returned 1 [0153.897] CloseHandle (hObject=0x10c) returned 1 [0153.897] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243304658555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243304658555b315d.jpg")) returned 0 [0153.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243304658555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243304658555b315d.jpg")) returned 0x2020 [0153.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 0x325098 [0153.898] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 0 [0153.899] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0153.899] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg")) returned 1 [0153.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg")) returned 0xffffffff [0153.900] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 1 [0153.900] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0153.900] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.900] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0153.900] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0153.900] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0153.900] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e0) returned 0x10ab [0153.900] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0153.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243304658555B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243304658555b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0153.901] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fd1 [0153.901] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0153.902] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0153.993] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2fd1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2fd1, lpOverlapped=0x0) returned 1 [0153.995] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2fe0, lpOverlapped=0x0) returned 1 [0153.996] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.019] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.030] CloseHandle (hObject=0x10c) returned 1 [0154.030] CloseHandle (hObject=0x108) returned 1 [0154.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243304658555B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243304658555b325d.jpg")) returned 0 [0154.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243304658555B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243304658555b325d.jpg")) returned 0x2020 [0154.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 0x325098 [0154.031] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 0 [0154.031] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0154.031] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg")) returned 1 [0154.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg")) returned 0xffffffff [0154.032] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1 [0154.033] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0154.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0154.033] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0154.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad00) returned 0x10ab [0154.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0154.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306D6B675B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306d6b675b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0154.034] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c3 [0154.034] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0154.034] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0154.124] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29c3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x29c3, lpOverlapped=0x0) returned 1 [0154.126] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x29d0, lpOverlapped=0x0) returned 1 [0154.127] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.150] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.161] CloseHandle (hObject=0x108) returned 1 [0154.161] CloseHandle (hObject=0x10c) returned 1 [0154.162] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306D6B675B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306d6b675b315d.jpg")) returned 0 [0154.162] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306D6B675B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306d6b675b315d.jpg")) returned 0x2020 [0154.162] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0x325098 [0154.163] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0 [0154.163] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0154.163] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg")) returned 1 [0154.164] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg")) returned 0xffffffff [0154.164] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 1 [0154.164] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0154.164] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.164] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0154.164] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0154.165] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b09c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0154.165] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.165] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b09c) returned 0x10ab [0154.165] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0154.165] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0154.165] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306D6B675B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306d6b675b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0154.166] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7b [0154.166] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0154.166] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0154.240] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa7b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xa7b, lpOverlapped=0x0) returned 1 [0154.247] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xa80, lpOverlapped=0x0) returned 1 [0154.248] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.271] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.282] CloseHandle (hObject=0x10c) returned 1 [0154.282] CloseHandle (hObject=0x108) returned 1 [0154.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306D6B675B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306d6b675b325d.jpg")) returned 0 [0154.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306D6B675B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306d6b675b325d.jpg")) returned 0x2020 [0154.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 0x325098 [0154.284] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 0 [0154.284] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0154.284] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg")) returned 1 [0154.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg")) returned 0xffffffff [0154.285] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 1 [0154.286] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0154.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0154.286] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aee4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0154.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aee4) returned 0x10ab [0154.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0154.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306F51695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306f51695b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0154.287] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17af [0154.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0154.287] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0154.377] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x17af, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x17af, lpOverlapped=0x0) returned 1 [0154.379] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x17b0, lpOverlapped=0x0) returned 1 [0154.380] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.428] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.439] CloseHandle (hObject=0x108) returned 1 [0154.439] CloseHandle (hObject=0x10c) returned 1 [0154.439] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306F51695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306f51695b315d.jpg")) returned 0 [0154.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243306F51695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243306f51695b315d.jpg")) returned 0x2020 [0154.440] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 0x325098 [0154.440] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 0 [0154.440] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0154.440] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg")) returned 1 [0154.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg")) returned 0xffffffff [0154.441] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1 [0154.442] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0154.442] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.442] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0154.442] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0154.442] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b09c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0154.442] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.442] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b09c) returned 0x10ab [0154.443] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0154.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0154.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243307443695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243307443695b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0154.444] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf3 [0154.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0154.444] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0154.527] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xaf3, lpOverlapped=0x0) returned 1 [0154.530] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb00, lpOverlapped=0x0) returned 1 [0154.531] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.553] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.569] CloseHandle (hObject=0x10c) returned 1 [0154.569] CloseHandle (hObject=0x108) returned 1 [0154.570] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243307443695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243307443695b315d.jpg")) returned 0 [0154.571] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424243307443695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424243307443695b315d.jpg")) returned 0x2020 [0154.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0x325098 [0154.571] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0 [0154.571] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0154.571] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg")) returned 1 [0154.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg")) returned 0xffffffff [0154.573] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 1 [0154.573] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0154.573] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.573] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0154.574] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0154.574] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.574] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0154.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0154.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242434D3255325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242434d3255325b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0154.575] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350a [0154.575] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0154.575] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0154.676] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x350a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x350a, lpOverlapped=0x0) returned 1 [0154.678] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3510, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3510, lpOverlapped=0x0) returned 1 [0154.679] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.702] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.713] CloseHandle (hObject=0x108) returned 1 [0154.713] CloseHandle (hObject=0x10c) returned 1 [0154.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242434D3255325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242434d3255325b315d.jpg")) returned 0 [0154.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242434D3255325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242434d3255325b315d.jpg")) returned 0x2020 [0154.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 0x325098 [0154.714] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 0 [0154.714] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0154.714] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg")) returned 1 [0154.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg")) returned 0xffffffff [0154.715] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 1 [0154.716] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0154.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.716] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0154.716] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0154.716] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afe4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0154.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.716] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afe4) returned 0x10ab [0154.716] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0154.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0154.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424244475462785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424244475462785b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0154.718] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68c [0154.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0154.718] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0154.807] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x68c, lpOverlapped=0x0) returned 1 [0154.808] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x690, lpOverlapped=0x0) returned 1 [0154.809] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.832] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.843] CloseHandle (hObject=0x10c) returned 1 [0154.843] CloseHandle (hObject=0x108) returned 1 [0154.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424244475462785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424244475462785b315d.jpg")) returned 0 [0154.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424244475462785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424244475462785b315d.jpg")) returned 0x2020 [0154.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 0x325098 [0154.844] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 0 [0154.844] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0154.844] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg")) returned 1 [0154.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg")) returned 0xffffffff [0154.845] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 1 [0154.846] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0154.846] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.846] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0154.846] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0154.846] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0154.846] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.846] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0154.846] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0154.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0154.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242446B34346D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242446b34346d5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0154.847] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x284 [0154.847] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0154.848] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0154.924] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x284, lpOverlapped=0x0) returned 1 [0154.933] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x290, lpOverlapped=0x0) returned 1 [0154.936] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.967] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.978] CloseHandle (hObject=0x108) returned 1 [0154.978] CloseHandle (hObject=0x10c) returned 1 [0154.979] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242446B34346D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242446b34346d5b315d.png")) returned 0 [0154.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242446B34346D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242446b34346d5b315d.png")) returned 0x2020 [0154.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 0x325098 [0154.981] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 0 [0154.981] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0154.981] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png")) returned 1 [0154.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png")) returned 0xffffffff [0154.982] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 1 [0154.983] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0154.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0154.983] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0154.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0154.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa84) returned 0x10ab [0154.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0154.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424457586F435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424457586f435b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0154.985] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d04 [0154.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0154.985] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0155.078] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d04, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2d04, lpOverlapped=0x0) returned 1 [0155.081] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d10, lpOverlapped=0x0) returned 1 [0155.082] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.105] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.116] CloseHandle (hObject=0x10c) returned 1 [0155.116] CloseHandle (hObject=0x108) returned 1 [0155.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424457586F435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424457586f435b315d.jpg")) returned 0 [0155.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424457586F435B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424457586f435b315d.jpg")) returned 0x2020 [0155.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 0x325098 [0155.117] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 0 [0155.117] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0155.117] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg")) returned 1 [0155.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg")) returned 0xffffffff [0155.118] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 1 [0155.121] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0155.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0155.121] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae64, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0155.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae64) returned 0x10ab [0155.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0155.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245334E63485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245334e63485b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0155.122] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x863 [0155.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0155.122] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0155.240] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x863, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x863, lpOverlapped=0x0) returned 1 [0155.269] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x870, lpOverlapped=0x0) returned 1 [0155.270] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.293] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.304] CloseHandle (hObject=0x108) returned 1 [0155.304] CloseHandle (hObject=0x10c) returned 1 [0155.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245334E63485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245334e63485b315d.jpg")) returned 0 [0155.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245334E63485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245334e63485b315d.jpg")) returned 0x2020 [0155.305] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 0x325098 [0155.305] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 0 [0155.305] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0155.305] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg")) returned 1 [0155.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg")) returned 0xffffffff [0155.307] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 1 [0155.308] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0155.308] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.308] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0155.308] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0155.308] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0155.308] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.308] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0155.308] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0155.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0155.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424537474C455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424537474c455b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0155.309] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b5 [0155.309] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0155.310] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0155.345] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2b5, lpOverlapped=0x0) returned 1 [0155.347] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2c0, lpOverlapped=0x0) returned 1 [0155.348] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.371] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.381] CloseHandle (hObject=0x10c) returned 1 [0155.381] CloseHandle (hObject=0x108) returned 1 [0155.382] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424537474C455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424537474c455b315d.png")) returned 0 [0155.382] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424537474C455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424537474c455b315d.png")) returned 0x2020 [0155.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 0x325098 [0155.383] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 0 [0155.383] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0155.383] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png")) returned 1 [0155.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png")) returned 0xffffffff [0155.407] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 1 [0155.407] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0155.407] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.407] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0155.407] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0155.408] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0155.408] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.408] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0155.408] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0155.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0155.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424538614C4F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424538614c4f5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0155.409] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c9b [0155.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0155.409] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0155.486] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c9b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c9b, lpOverlapped=0x0) returned 1 [0155.488] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1ca0, lpOverlapped=0x0) returned 1 [0155.489] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.512] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.523] CloseHandle (hObject=0x108) returned 1 [0155.523] CloseHandle (hObject=0x10c) returned 1 [0155.524] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424538614C4F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424538614c4f5b315d.jpg")) returned 0 [0155.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424538614C4F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424538614c4f5b315d.jpg")) returned 0x2020 [0155.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 0x325098 [0155.525] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 0 [0155.525] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0155.525] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg")) returned 1 [0155.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg")) returned 0xffffffff [0155.526] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 1 [0155.527] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0155.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0155.527] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0155.527] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b104, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0155.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b104) returned 0x10ab [0155.527] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0155.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0155.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245643562465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245643562465b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0155.528] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x702 [0155.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0155.529] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0155.667] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x702, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x702, lpOverlapped=0x0) returned 1 [0155.669] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x710, lpOverlapped=0x0) returned 1 [0155.670] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.692] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.704] CloseHandle (hObject=0x10c) returned 1 [0155.704] CloseHandle (hObject=0x108) returned 1 [0155.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245643562465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245643562465b315d.jpg")) returned 0 [0155.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245643562465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245643562465b315d.jpg")) returned 0x2020 [0155.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 0x325098 [0155.705] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 0 [0155.705] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0155.705] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg")) returned 1 [0155.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg")) returned 0xffffffff [0155.707] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 1 [0155.707] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0155.707] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.707] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0155.707] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa04, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0155.707] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.707] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa04) returned 0x10ab [0155.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0155.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424564444E6D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424564444e6d5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0155.709] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaca8 [0155.709] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0155.710] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0155.799] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaca8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xaca8, lpOverlapped=0x0) returned 1 [0155.802] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xacb0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xacb0, lpOverlapped=0x0) returned 1 [0155.804] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.826] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.838] CloseHandle (hObject=0x108) returned 1 [0155.838] CloseHandle (hObject=0x10c) returned 1 [0155.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424564444E6D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424564444e6d5b315d.jpg")) returned 0 [0155.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424564444E6D5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424564444e6d5b315d.jpg")) returned 0x2020 [0155.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 0x325098 [0155.839] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 0 [0155.839] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0155.839] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg")) returned 1 [0155.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg")) returned 0xffffffff [0155.841] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 1 [0155.841] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0155.841] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.841] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0155.841] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adf8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0155.841] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.841] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adf8) returned 0x10ab [0155.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0155.842] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245647079725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245647079725b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0155.842] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x755 [0155.842] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0155.842] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0155.916] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x755, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x755, lpOverlapped=0x0) returned 1 [0155.919] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x760, lpOverlapped=0x0) returned 1 [0155.920] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.942] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.953] CloseHandle (hObject=0x10c) returned 1 [0155.953] CloseHandle (hObject=0x108) returned 1 [0155.954] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245647079725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245647079725b315d.jpg")) returned 0 [0155.954] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245647079725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245647079725b315d.jpg")) returned 0x2020 [0155.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 0x325098 [0155.954] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 0 [0155.955] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0155.955] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg")) returned 1 [0155.955] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg")) returned 0xffffffff [0155.956] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 1 [0155.956] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0155.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0155.956] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0155.957] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0155.957] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0155.957] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0155.957] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0155.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0155.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245645164765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245645164765b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0155.958] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c72 [0155.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0155.958] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0156.063] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c72, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c72, lpOverlapped=0x0) returned 1 [0156.065] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1c80, lpOverlapped=0x0) returned 1 [0156.066] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.090] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.104] CloseHandle (hObject=0x108) returned 1 [0156.104] CloseHandle (hObject=0x10c) returned 1 [0156.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245645164765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245645164765b315d.jpg")) returned 0 [0156.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245645164765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245645164765b315d.jpg")) returned 0x2020 [0156.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 0x325098 [0156.108] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 0 [0156.108] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0156.108] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg")) returned 1 [0156.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg")) returned 0xffffffff [0156.109] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 1 [0156.114] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0156.114] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.116] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0156.116] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0156.117] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0156.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0156.117] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0156.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0156.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245653632745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245653632745b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0156.118] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa23 [0156.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0156.118] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0156.215] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa23, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xa23, lpOverlapped=0x0) returned 1 [0156.221] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xa30, lpOverlapped=0x0) returned 1 [0156.222] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.245] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.256] CloseHandle (hObject=0x10c) returned 1 [0156.256] CloseHandle (hObject=0x108) returned 1 [0156.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245653632745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245653632745b315d.jpg")) returned 0 [0156.258] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245653632745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245653632745b315d.jpg")) returned 0x2020 [0156.258] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 0x325098 [0156.258] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 0 [0156.258] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0156.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg")) returned 1 [0156.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg")) returned 0xffffffff [0156.259] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 1 [0156.260] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0156.260] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.260] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0156.260] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0156.260] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0156.260] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.260] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0e8) returned 0x10ab [0156.260] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0156.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0156.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245656450525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245656450525b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0156.263] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ca7 [0156.263] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0156.263] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0156.353] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ca7, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1ca7, lpOverlapped=0x0) returned 1 [0156.355] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1cb0, lpOverlapped=0x0) returned 1 [0156.356] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.381] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.404] CloseHandle (hObject=0x108) returned 1 [0156.404] CloseHandle (hObject=0x10c) returned 1 [0156.404] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245656450525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245656450525b315d.jpg")) returned 0 [0156.405] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245656450525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245656450525b315d.jpg")) returned 0x2020 [0156.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 0x325098 [0156.405] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 0 [0156.405] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0156.405] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg")) returned 1 [0156.406] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg")) returned 0xffffffff [0156.406] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 1 [0156.407] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0156.407] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.407] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0156.407] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0156.407] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.407] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa0c) returned 0x10ab [0156.407] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0156.407] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655470425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655470425b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0156.408] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ef [0156.408] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0156.408] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0156.492] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9ef, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9ef, lpOverlapped=0x0) returned 1 [0156.494] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9f0, lpOverlapped=0x0) returned 1 [0156.495] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.517] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.529] CloseHandle (hObject=0x10c) returned 1 [0156.529] CloseHandle (hObject=0x108) returned 1 [0156.529] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655470425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655470425b315d.jpg")) returned 0 [0156.530] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655470425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655470425b315d.jpg")) returned 0x2020 [0156.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 0x325098 [0156.530] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 0 [0156.530] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0156.530] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg")) returned 1 [0156.531] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg")) returned 0xffffffff [0156.531] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1 [0156.531] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0156.531] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.531] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0156.531] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ade0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0156.531] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.532] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ade0) returned 0x10ab [0156.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0156.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655475665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655475665b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0156.533] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x952 [0156.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0156.533] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0156.624] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x952, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x952, lpOverlapped=0x0) returned 1 [0156.633] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x960, lpOverlapped=0x0) returned 1 [0156.634] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.658] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.672] CloseHandle (hObject=0x108) returned 1 [0156.672] CloseHandle (hObject=0x10c) returned 1 [0156.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655475665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655475665b315d.jpg")) returned 0 [0156.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655475665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655475665b315d.jpg")) returned 0x2020 [0156.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0x325098 [0156.673] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0 [0156.674] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0156.674] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg")) returned 1 [0156.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg")) returned 0xffffffff [0156.675] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 1 [0156.675] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0156.675] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.675] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0156.675] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0156.676] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0156.676] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.676] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0156.676] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0156.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0156.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655535555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655535555b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0156.677] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a9 [0156.677] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0156.678] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0156.780] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7a9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7a9, lpOverlapped=0x0) returned 1 [0156.782] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7b0, lpOverlapped=0x0) returned 1 [0156.784] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.813] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.825] CloseHandle (hObject=0x10c) returned 1 [0156.825] CloseHandle (hObject=0x108) returned 1 [0156.825] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655535555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655535555b315d.jpg")) returned 0 [0156.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245655535555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245655535555b315d.jpg")) returned 0x2020 [0156.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 0x325098 [0156.826] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 0 [0156.826] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0156.826] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg")) returned 1 [0156.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg")) returned 0xffffffff [0156.827] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 1 [0156.828] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0156.828] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.828] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0156.828] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0156.828] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.828] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa84) returned 0x10ab [0156.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0156.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245663330365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245663330365b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0156.829] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86f [0156.829] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0156.829] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0156.904] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x86f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x86f, lpOverlapped=0x0) returned 1 [0156.911] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x870, lpOverlapped=0x0) returned 1 [0156.912] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.936] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.947] CloseHandle (hObject=0x108) returned 1 [0156.947] CloseHandle (hObject=0x10c) returned 1 [0156.947] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245663330365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245663330365b315d.jpg")) returned 0 [0156.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245663330365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245663330365b315d.jpg")) returned 0x2020 [0156.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 0x325098 [0156.948] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 0 [0156.948] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0156.949] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg")) returned 1 [0156.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg")) returned 0xffffffff [0156.950] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 1 [0156.950] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0156.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0156.950] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0156.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0156.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab7c) returned 0x10ab [0156.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0156.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245663534525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245663534525b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0156.951] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x828 [0156.952] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0156.952] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0157.043] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x828, lpOverlapped=0x0) returned 1 [0157.044] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x830, lpOverlapped=0x0) returned 1 [0157.045] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.068] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.080] CloseHandle (hObject=0x10c) returned 1 [0157.080] CloseHandle (hObject=0x108) returned 1 [0157.080] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245663534525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245663534525b315d.jpg")) returned 0 [0157.081] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245663534525B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245663534525b315d.jpg")) returned 0x2020 [0157.081] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 0x325098 [0157.081] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 0 [0157.081] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0157.081] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg")) returned 1 [0157.082] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg")) returned 0xffffffff [0157.082] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 1 [0157.082] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0157.082] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.082] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0157.082] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0157.083] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af80, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0157.083] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.083] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af80) returned 0x10ab [0157.083] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0157.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0157.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245664262485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245664262485b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0157.084] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3860 [0157.084] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0157.085] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0157.181] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3860, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3860, lpOverlapped=0x0) returned 1 [0157.183] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3870, lpOverlapped=0x0) returned 1 [0157.185] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.210] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.221] CloseHandle (hObject=0x108) returned 1 [0157.221] CloseHandle (hObject=0x10c) returned 1 [0157.221] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245664262485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245664262485b315d.jpg")) returned 0 [0157.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245664262485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245664262485b315d.jpg")) returned 0x2020 [0157.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 0x325098 [0157.222] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 0 [0157.222] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0157.222] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg")) returned 1 [0157.223] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg")) returned 0xffffffff [0157.223] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 1 [0157.224] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0157.224] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.224] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0157.224] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0157.225] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0157.225] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.225] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0157.225] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0157.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0157.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245664271305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245664271305b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0157.226] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a5 [0157.226] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0157.227] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0157.316] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19a5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x19a5, lpOverlapped=0x0) returned 1 [0157.318] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x19b0, lpOverlapped=0x0) returned 1 [0157.319] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.342] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.353] CloseHandle (hObject=0x10c) returned 1 [0157.353] CloseHandle (hObject=0x108) returned 1 [0157.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245664271305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245664271305b315d.jpg")) returned 0 [0157.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245664271305B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245664271305b315d.jpg")) returned 0x2020 [0157.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 0x325098 [0157.354] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 0 [0157.354] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0157.354] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg")) returned 1 [0157.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg")) returned 0xffffffff [0157.355] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 1 [0157.356] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0157.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0157.356] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0157.356] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0157.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0157.356] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0157.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0157.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242456642727A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242456642727a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0157.357] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2619 [0157.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0157.358] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0157.446] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2619, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2619, lpOverlapped=0x0) returned 1 [0157.453] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2620, lpOverlapped=0x0) returned 1 [0157.455] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.478] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.489] CloseHandle (hObject=0x108) returned 1 [0157.489] CloseHandle (hObject=0x10c) returned 1 [0157.489] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242456642727A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242456642727a5b315d.jpg")) returned 0 [0157.503] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4242456642727A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4242456642727a5b315d.jpg")) returned 0x2020 [0157.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 0x325098 [0157.504] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 0 [0157.504] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0157.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg")) returned 1 [0157.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg")) returned 0xffffffff [0157.505] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 1 [0157.506] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0157.506] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.506] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0157.506] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0157.506] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.506] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e0) returned 0x10ab [0157.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0157.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424566586C365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424566586c365b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0157.507] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f84 [0157.507] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0157.508] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0157.628] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f84, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1f84, lpOverlapped=0x0) returned 1 [0157.629] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1f90, lpOverlapped=0x0) returned 1 [0157.630] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.654] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.665] CloseHandle (hObject=0x10c) returned 1 [0157.665] CloseHandle (hObject=0x108) returned 1 [0157.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424566586C365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424566586c365b315d.jpg")) returned 0 [0157.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424566586C365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424566586c365b315d.jpg")) returned 0x2020 [0157.666] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 0x325098 [0157.666] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 0 [0157.666] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0157.667] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg")) returned 1 [0157.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg")) returned 0xffffffff [0157.668] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 1 [0157.668] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0157.668] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.668] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0157.668] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0157.668] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.668] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad00) returned 0x10ab [0157.668] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0157.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245674548335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245674548335b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0157.669] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c7e [0157.669] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0157.669] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0157.776] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c7e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c7e, lpOverlapped=0x0) returned 1 [0157.833] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1c80, lpOverlapped=0x0) returned 1 [0157.834] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.858] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.869] CloseHandle (hObject=0x108) returned 1 [0157.869] CloseHandle (hObject=0x10c) returned 1 [0157.870] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245674548335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245674548335b315d.jpg")) returned 0 [0157.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245674548335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245674548335b315d.jpg")) returned 0x2020 [0157.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 0x325098 [0157.871] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 0 [0157.871] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0157.871] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg")) returned 1 [0157.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg")) returned 0xffffffff [0157.873] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1 [0157.873] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0157.873] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.873] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0157.873] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0157.874] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b09c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0157.874] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.874] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b09c) returned 0x10ab [0157.874] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0157.874] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0157.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424567737A335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424567737a335b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0157.876] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f9 [0157.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0157.876] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0157.909] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8f9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x8f9, lpOverlapped=0x0) returned 1 [0157.910] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x900, lpOverlapped=0x0) returned 1 [0157.911] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.936] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.947] CloseHandle (hObject=0x10c) returned 1 [0157.947] CloseHandle (hObject=0x108) returned 1 [0157.947] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424567737A335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424567737a335b315d.jpg")) returned 0 [0157.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42424567737A335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42424567737a335b315d.jpg")) returned 0x2020 [0157.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0x325098 [0157.948] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0 [0157.948] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0157.948] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg")) returned 1 [0157.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg")) returned 0xffffffff [0157.949] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 1 [0157.950] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0157.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0157.950] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aee4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0157.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0157.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aee4) returned 0x10ab [0157.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0157.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245675478425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245675478425b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0157.954] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b7 [0157.954] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0157.955] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0158.008] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9b7, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9b7, lpOverlapped=0x0) returned 1 [0158.009] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9c0, lpOverlapped=0x0) returned 1 [0158.010] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.033] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.045] CloseHandle (hObject=0x108) returned 1 [0158.045] CloseHandle (hObject=0x10c) returned 1 [0158.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245675478425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245675478425b315d.jpg")) returned 0 [0158.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424245675478425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424245675478425b315d.jpg")) returned 0x2020 [0158.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 0x325098 [0158.046] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 0 [0158.047] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0158.047] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg")) returned 1 [0158.048] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg")) returned 0xffffffff [0158.048] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 1 [0158.048] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0158.048] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.048] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0158.048] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0158.049] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b09c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0158.049] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.049] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b09c) returned 0x10ab [0158.049] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0158.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0158.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42426F316C464A5B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42426f316c464a5b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0158.050] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36e [0158.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0158.050] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0158.139] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x36e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x36e, lpOverlapped=0x0) returned 1 [0158.141] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x370, lpOverlapped=0x0) returned 1 [0158.142] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.165] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.175] CloseHandle (hObject=0x10c) returned 1 [0158.175] CloseHandle (hObject=0x108) returned 1 [0158.176] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42426F316C464A5B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42426f316c464a5b325d.png")) returned 0 [0158.177] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\42426F316C464A5B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\42426f316c464a5b325d.png")) returned 0x2020 [0158.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 0x325098 [0158.177] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 0 [0158.177] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0158.177] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png")) returned 1 [0158.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png")) returned 0xffffffff [0158.178] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 1 [0158.178] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0158.178] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.179] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0158.179] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0158.179] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.179] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac90) returned 0x10ab [0158.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0158.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424273343754455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424273343754455b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0158.180] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23f [0158.180] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0158.180] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0158.277] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x23f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x23f, lpOverlapped=0x0) returned 1 [0158.278] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x240, lpOverlapped=0x0) returned 1 [0158.279] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.302] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.313] CloseHandle (hObject=0x108) returned 1 [0158.313] CloseHandle (hObject=0x10c) returned 1 [0158.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424273343754455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424273343754455b315d.png")) returned 0 [0158.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424273343754455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424273343754455b315d.png")) returned 0x2020 [0158.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 0x325098 [0158.314] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 0 [0158.314] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0158.314] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png")) returned 1 [0158.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png")) returned 0xffffffff [0158.315] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 1 [0158.316] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0158.316] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.316] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0158.316] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0158.316] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afe4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0158.316] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.316] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afe4) returned 0x10ab [0158.317] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0158.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0158.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424275397357515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424275397357515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0158.318] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cb0 [0158.318] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0158.318] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0158.422] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2cb0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2cb0, lpOverlapped=0x0) returned 1 [0158.424] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2cc0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2cc0, lpOverlapped=0x0) returned 1 [0158.425] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.448] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.459] CloseHandle (hObject=0x10c) returned 1 [0158.460] CloseHandle (hObject=0x108) returned 1 [0158.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424275397357515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424275397357515b315d.jpg")) returned 0 [0158.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424275397357515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424275397357515b315d.jpg")) returned 0x2020 [0158.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 0x325098 [0158.461] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 0 [0158.461] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0158.461] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg")) returned 1 [0158.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg")) returned 0xffffffff [0158.462] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 1 [0158.462] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0158.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0158.462] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0158.463] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0158.463] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.463] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0158.463] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0158.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0158.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424279617A69665B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424279617a69665b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0158.464] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x228c [0158.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0158.464] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0158.547] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x228c, lpOverlapped=0x0) returned 1 [0158.558] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2290, lpOverlapped=0x0) returned 1 [0158.562] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.609] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.623] CloseHandle (hObject=0x108) returned 1 [0158.623] CloseHandle (hObject=0x10c) returned 1 [0158.626] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424279617A69665B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424279617a69665b325d.jpg")) returned 0 [0158.627] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\424279617A69665B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\424279617a69665b325d.jpg")) returned 0x2020 [0158.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 0x325098 [0158.627] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 0 [0158.627] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0158.627] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg")) returned 1 [0158.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg")) returned 0xffffffff [0158.629] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 1 [0158.632] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0158.632] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.634] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0158.634] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa78, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0158.634] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.634] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa78) returned 0x10ab [0158.634] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0158.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\62732D636F6D706F6E656E74735B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\62732d636f6d706f6e656e74735b315d.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0158.636] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf13 [0158.636] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0158.636] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0158.710] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaf13, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xaf13, lpOverlapped=0x0) returned 1 [0158.713] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xaf20, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xaf20, lpOverlapped=0x0) returned 1 [0158.714] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.737] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.749] CloseHandle (hObject=0x10c) returned 1 [0158.749] CloseHandle (hObject=0x108) returned 1 [0158.749] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\62732D636F6D706F6E656E74735B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\62732d636f6d706f6e656e74735b315d.css")) returned 0 [0158.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\62732D636F6D706F6E656E74735B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\62732d636f6d706f6e656e74735b315d.css")) returned 0x2020 [0158.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 0x325098 [0158.750] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 0 [0158.750] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0158.750] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css")) returned 1 [0158.751] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css")) returned 0xffffffff [0158.751] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 1 [0158.751] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0158.752] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.752] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0158.752] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af04, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0158.752] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.752] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af04) returned 0x10ab [0158.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0158.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\62732D7574696C5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\62732d7574696c5b315d.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0158.753] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30be [0158.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0158.753] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0158.842] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x30be, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x30be, lpOverlapped=0x0) returned 1 [0158.844] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x30c0, lpOverlapped=0x0) returned 1 [0158.846] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.868] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.879] CloseHandle (hObject=0x108) returned 1 [0158.879] CloseHandle (hObject=0x10c) returned 1 [0158.880] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\62732D7574696C5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\62732d7574696c5b315d.css")) returned 0 [0158.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\62732D7574696C5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\62732d7574696c5b315d.css")) returned 0x2020 [0158.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 0x325098 [0158.881] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 0 [0158.881] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0158.881] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css")) returned 1 [0158.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css")) returned 0xffffffff [0158.882] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 1 [0158.882] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0158.882] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.882] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0158.882] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0158.883] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b050, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0158.883] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0158.883] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b050) returned 0x10ab [0158.883] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0158.883] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0158.883] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\63372D6264626430642D39316364666263315B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\63372d6264626430642d39316364666263315b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0158.884] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x254f1 [0158.884] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0158.884] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0158.979] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x254f1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x254f1, lpOverlapped=0x0) returned 1 [0158.985] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x25500, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x25500, lpOverlapped=0x0) returned 1 [0158.988] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.011] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.022] CloseHandle (hObject=0x10c) returned 1 [0159.022] CloseHandle (hObject=0x108) returned 1 [0159.022] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\63372D6264626430642D39316364666263315B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\63372d6264626430642d39316364666263315b315d.txt")) returned 0 [0159.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\63372D6264626430642D39316364666263315B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\63372d6264626430642d39316364666263315b315d.txt")) returned 0x2020 [0159.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 0x325098 [0159.023] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 0 [0159.023] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0159.023] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt")) returned 1 [0159.025] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt")) returned 0xffffffff [0159.025] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0159.026] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.026] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.026] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.026] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0159.026] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0d4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.026] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.026] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0d4) returned 0x10ab [0159.026] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0159.027] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 1 [0159.027] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.027] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.027] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.027] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0159.027] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0d4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.027] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.027] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0d4) returned 0x10ab [0159.027] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0159.027] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 1 [0159.028] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.028] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.028] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.028] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0159.028] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0d4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.028] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.028] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0d4) returned 0x10ab [0159.028] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0159.028] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0159.029] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6368726F6D652E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6368726f6d652e6d696e5b315d.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0159.029] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a03f [0159.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0159.030] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0159.119] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2a03f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2a03f, lpOverlapped=0x0) returned 1 [0159.125] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a040, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2a040, lpOverlapped=0x0) returned 1 [0159.129] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.151] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.162] CloseHandle (hObject=0x108) returned 1 [0159.163] CloseHandle (hObject=0x10c) returned 1 [0159.163] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6368726F6D652E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6368726f6d652e6d696e5b315d.css")) returned 0 [0159.163] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6368726F6D652E6D696E5B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6368726f6d652e6d696e5b315d.css")) returned 0x2020 [0159.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 0x325098 [0159.164] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 0 [0159.164] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0159.164] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css")) returned 1 [0159.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css")) returned 0xffffffff [0159.166] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 1 [0159.166] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.166] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.166] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.166] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.166] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa48) returned 0x10ab [0159.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0159.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6368726F6D655F7468726F626265725F666173745F31365B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6368726f6d655f7468726f626265725f666173745f31365b315d.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0159.168] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60c [0159.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0159.168] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0159.244] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x60c, lpOverlapped=0x0) returned 1 [0159.245] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x610, lpOverlapped=0x0) returned 1 [0159.246] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.269] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.280] CloseHandle (hObject=0x10c) returned 1 [0159.280] CloseHandle (hObject=0x108) returned 1 [0159.280] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6368726F6D655F7468726F626265725F666173745F31365B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6368726f6d655f7468726f626265725f666173745f31365b315d.gif")) returned 0 [0159.281] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6368726F6D655F7468726F626265725F666173745F31365B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6368726f6d655f7468726f626265725f666173745f31365b315d.gif")) returned 0x2020 [0159.281] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 0x325098 [0159.281] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 0 [0159.281] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0159.281] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif")) returned 1 [0159.282] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif")) returned 0xffffffff [0159.282] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0159.283] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.283] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.283] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.283] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0159.283] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afc0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.283] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.283] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afc0) returned 0x10ab [0159.283] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0159.283] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0159.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\636F6C6C6563745B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\636f6c6c6563745b315d.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0159.285] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b [0159.285] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0159.285] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0159.373] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2b, lpOverlapped=0x0) returned 1 [0159.395] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x30, lpOverlapped=0x0) returned 1 [0159.396] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.418] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.429] CloseHandle (hObject=0x108) returned 1 [0159.429] CloseHandle (hObject=0x10c) returned 1 [0159.429] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\636F6C6C6563745B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\636f6c6c6563745b315d.gif")) returned 0 [0159.430] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\636F6C6C6563745B315D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\636f6c6c6563745b315d.gif")) returned 0x2020 [0159.430] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 0x325098 [0159.430] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 0 [0159.431] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0159.431] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif")) returned 1 [0159.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif")) returned 0xffffffff [0159.432] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0159.432] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.432] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.432] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.433] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0159.433] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b040, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.433] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.433] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b040) returned 0x10ab [0159.433] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0159.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0159.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\436F6E7461696E65725461675B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\436f6e7461696e65725461675b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0159.435] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b1 [0159.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0159.435] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0159.517] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7b1, lpOverlapped=0x0) returned 1 [0159.527] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7c0, lpOverlapped=0x0) returned 1 [0159.528] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.551] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.562] CloseHandle (hObject=0x10c) returned 1 [0159.562] CloseHandle (hObject=0x108) returned 1 [0159.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\436F6E7461696E65725461675B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\436f6e7461696e65725461675b315d.js")) returned 0 [0159.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\436F6E7461696E65725461675B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\436f6e7461696e65725461675b315d.js")) returned 0x2020 [0159.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 0x325098 [0159.563] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 0 [0159.563] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0159.563] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js")) returned 1 [0159.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js")) returned 0xffffffff [0159.564] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0159.565] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.565] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.565] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.565] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.565] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.565] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae08) returned 0x10ab [0159.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0159.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0159.567] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0159.567] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0159.567] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0159.695] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x43, lpOverlapped=0x0) returned 1 [0159.696] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x50, lpOverlapped=0x0) returned 1 [0159.697] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.719] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.730] CloseHandle (hObject=0x108) returned 1 [0159.730] CloseHandle (hObject=0x10c) returned 1 [0159.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6465736b746f70.ini")) returned 0 [0159.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6465736b746f70.ini")) returned 0x2020 [0159.731] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325098 [0159.731] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0159.731] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0159.731] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini")) returned 1 [0159.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini")) returned 0xffffffff [0159.732] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 1 [0159.733] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.733] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.733] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.733] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0159.733] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.733] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.733] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0159.733] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0159.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0159.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\65756C612D6D61635B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\65756c612d6d61635b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0159.735] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48ba [0159.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0159.735] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0159.825] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x48ba, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x48ba, lpOverlapped=0x0) returned 1 [0159.827] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x48c0, lpOverlapped=0x0) returned 1 [0159.828] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.851] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.862] CloseHandle (hObject=0x10c) returned 1 [0159.862] CloseHandle (hObject=0x108) returned 1 [0159.862] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\65756C612D6D61635B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\65756c612d6d61635b315d.jpg")) returned 0 [0159.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\65756C612D6D61635B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\65756c612d6d61635b315d.jpg")) returned 0x2020 [0159.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 0x325098 [0159.863] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 0 [0159.863] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0159.864] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg")) returned 1 [0159.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg")) returned 0xffffffff [0159.865] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 1 [0159.865] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0159.865] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.865] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0159.865] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0159.865] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0159.865] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0159.865] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b088) returned 0x10ab [0159.866] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0159.866] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0159.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\67615B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\67615b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0159.867] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa84a [0159.867] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0159.867] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0159.954] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa84a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xa84a, lpOverlapped=0x0) returned 1 [0159.961] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa850, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xa850, lpOverlapped=0x0) returned 1 [0159.963] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.993] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.008] CloseHandle (hObject=0x108) returned 1 [0160.008] CloseHandle (hObject=0x10c) returned 1 [0160.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\67615B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\67615b315d.js")) returned 0 [0160.009] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\67615B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\67615b315d.js")) returned 0x2020 [0160.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 0x325098 [0160.009] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 0 [0160.009] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0160.010] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js")) returned 1 [0160.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js")) returned 0xffffffff [0160.011] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe1f6d70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~1")) returned 1 [0160.013] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.013] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.013] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.013] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.013] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.013] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.013] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0160.014] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.014] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 1 [0160.014] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.014] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.014] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.014] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.015] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.015] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.015] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0160.015] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.015] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf03f170, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf03f170, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf0652d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0160.015] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.015] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.015] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.015] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.016] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.016] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0160.016] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.016] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2544b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2544b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2544b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0160.017] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.017] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.017] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.018] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0160.018] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.018] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0160.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.018] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.019] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.019] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.019] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0160.019] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.019] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 1 [0160.019] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.019] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.019] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.020] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.020] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.020] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.020] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0160.020] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.020] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 1 [0160.020] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.020] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.020] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.020] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.021] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.021] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.021] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0160.021] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0160.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6D6F6465726E697A725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6d6f6465726e697a725b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0160.023] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46c9 [0160.023] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0160.023] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0160.136] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x46c9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x46c9, lpOverlapped=0x0) returned 1 [0160.141] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x46d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x46d0, lpOverlapped=0x0) returned 1 [0160.143] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.172] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.186] CloseHandle (hObject=0x10c) returned 1 [0160.187] CloseHandle (hObject=0x108) returned 1 [0160.187] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6D6F6465726E697A725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6d6f6465726e697a725b315d.js")) returned 0 [0160.188] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6D6F6465726E697A725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6d6f6465726e697a725b315d.js")) returned 0x2020 [0160.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 0x325098 [0160.188] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 0 [0160.188] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0160.188] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js")) returned 1 [0160.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js")) returned 0xffffffff [0160.190] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 1 [0160.190] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.190] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.190] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.190] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.190] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.190] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e4) returned 0x10ab [0160.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0160.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4D534E496453796E635B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4d534e496453796e635b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0160.192] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec5 [0160.192] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0160.192] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0160.310] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xec5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xec5, lpOverlapped=0x0) returned 1 [0160.312] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xed0, lpOverlapped=0x0) returned 1 [0160.314] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.338] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.350] CloseHandle (hObject=0x108) returned 1 [0160.350] CloseHandle (hObject=0x10c) returned 1 [0160.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4D534E496453796E635B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4d534e496453796e635b315d.js")) returned 0 [0160.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\4D534E496453796E635B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\4d534e496453796e635b315d.js")) returned 0x2020 [0160.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 0x325098 [0160.352] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 0 [0160.352] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0160.352] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js")) returned 1 [0160.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js")) returned 0xffffffff [0160.353] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0160.354] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.354] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac8c) returned 0x10ab [0160.354] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0160.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6F6E6C795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6f6e6c795b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0160.356] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0160.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0160.356] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0160.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6F6E6C795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6f6e6c795b315d.htm")) returned 0 [0160.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\6F6E6C795B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\6f6e6c795b315d.htm")) returned 0x2020 [0160.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 0x325098 [0160.489] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 0 [0160.489] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0160.489] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm")) returned 1 [0160.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm")) returned 0xffffffff [0160.489] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 1 [0160.490] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.490] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.490] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.490] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.490] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b07c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.490] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.490] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b07c) returned 0x10ab [0160.490] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.490] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0160.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\706C617965725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\706c617965725b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0160.492] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b6d [0160.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0160.492] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0160.593] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6b6d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x6b6d, lpOverlapped=0x0) returned 1 [0160.598] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6b70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x6b70, lpOverlapped=0x0) returned 1 [0160.599] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.622] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.633] CloseHandle (hObject=0x108) returned 1 [0160.633] CloseHandle (hObject=0x10c) returned 1 [0160.633] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\706C617965725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\706c617965725b315d.js")) returned 0 [0160.634] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\706C617965725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\706c617965725b315d.js")) returned 0x2020 [0160.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 0x325098 [0160.634] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 0 [0160.634] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0160.634] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js")) returned 1 [0160.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js")) returned 0xffffffff [0160.635] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 1 [0160.635] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.635] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.636] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.636] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.636] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b050, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.636] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.636] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b050) returned 0x10ab [0160.636] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.636] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0160.636] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\706C617965725B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\706c617965725b325d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0160.637] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f44 [0160.637] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0160.637] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0160.728] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5f44, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x5f44, lpOverlapped=0x0) returned 1 [0160.736] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5f50, lpOverlapped=0x0) returned 1 [0160.739] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.770] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.782] CloseHandle (hObject=0x10c) returned 1 [0160.782] CloseHandle (hObject=0x108) returned 1 [0160.782] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\706C617965725B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\706c617965725b325d.js")) returned 0 [0160.784] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\706C617965725B325D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\706c617965725b325d.js")) returned 0x2020 [0160.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 0x325098 [0160.784] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 0 [0160.784] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0160.784] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js")) returned 1 [0160.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js")) returned 0xffffffff [0160.785] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1 [0160.786] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.786] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.786] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.786] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0160.787] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b050, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.787] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.787] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b050) returned 0x10ab [0160.787] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0160.787] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0160.788] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7465636A736C6F675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7465636a736c6f675b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0160.789] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67 [0160.789] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0160.789] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0160.865] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x67, lpOverlapped=0x0) returned 1 [0160.867] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x70, lpOverlapped=0x0) returned 1 [0160.868] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.891] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.902] CloseHandle (hObject=0x108) returned 1 [0160.902] CloseHandle (hObject=0x10c) returned 1 [0160.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7465636A736C6F675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7465636a736c6f675b315d.png")) returned 0 [0160.903] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7465636A736C6F675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7465636a736c6f675b315d.png")) returned 0x2020 [0160.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0x325098 [0160.903] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0 [0160.903] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0160.903] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png")) returned 1 [0160.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png")) returned 0xffffffff [0160.904] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 1 [0160.904] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0160.904] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.904] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0160.905] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad30, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0160.905] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0160.905] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad30) returned 0x10ab [0160.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0160.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7468616E6B796F755B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7468616e6b796f755b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0160.907] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x805a [0160.907] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0160.907] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0161.005] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x805a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x805a, lpOverlapped=0x0) returned 1 [0161.008] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8060, lpOverlapped=0x0) returned 1 [0161.009] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.033] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.044] CloseHandle (hObject=0x10c) returned 1 [0161.044] CloseHandle (hObject=0x108) returned 1 [0161.044] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7468616E6B796F755B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7468616e6b796f755b315d.htm")) returned 0 [0161.045] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7468616E6B796F755B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7468616e6b796f755b315d.htm")) returned 0x2020 [0161.045] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 0x325098 [0161.045] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 0 [0161.045] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0161.045] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm")) returned 1 [0161.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm")) returned 0xffffffff [0161.047] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 1 [0161.048] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0161.048] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.048] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0161.048] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0161.049] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b074, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0161.049] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.049] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b074) returned 0x10ab [0161.049] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0161.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0161.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\74685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\74685b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0161.050] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x911 [0161.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0161.050] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0161.141] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x911, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x911, lpOverlapped=0x0) returned 1 [0161.143] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x920, lpOverlapped=0x0) returned 1 [0161.144] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.167] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.178] CloseHandle (hObject=0x108) returned 1 [0161.178] CloseHandle (hObject=0x10c) returned 1 [0161.178] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\74685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\74685b315d.jpg")) returned 0 [0161.179] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\74685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\74685b315d.jpg")) returned 0x2020 [0161.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0x325098 [0161.179] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0 [0161.179] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0161.179] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg")) returned 1 [0161.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg")) returned 0xffffffff [0161.180] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0 [0161.180] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0161.180] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x6d74682e, dwReserved1=0x746f652e, cFileName="index.dat", cAlternateFileName="")) returned 1 [0161.181] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0161.181] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.181] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0161.181] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0161.181] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b074, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0161.181] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.182] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b074) returned 0x10ab [0161.182] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0161.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0161.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0161.183] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54000 [0161.183] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0161.184] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0161.280] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x54000, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x54000, lpOverlapped=0x0) returned 1 [0161.290] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x54010, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x54010, lpOverlapped=0x0) returned 1 [0161.297] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.320] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.331] CloseHandle (hObject=0x110) returned 1 [0161.331] CloseHandle (hObject=0x10c) returned 1 [0161.331] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\696e646578.dat")) returned 0 [0161.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\696e646578.dat")) returned 0x2020 [0161.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325058 [0161.333] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0161.333] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0161.333] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat")) returned 1 [0161.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat")) returned 0xffffffff [0161.336] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1 [0161.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe200e0, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0161.339] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe200e0, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0161.340] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0xe200e0, dwReserved1=0x31e3e0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 1 [0161.341] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0161.341] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.341] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0161.341] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad80, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0161.341] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.341] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad80) returned 0x10ab [0161.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0161.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\30666639323932342D663835372D343931652D613265652D6330666532306630643036345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\30666639323932342d663835372d343931652d613265652d6330666532306630643036345b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0161.343] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f7e [0161.343] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0161.343] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0161.433] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7f7e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7f7e, lpOverlapped=0x0) returned 1 [0161.436] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7f80, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7f80, lpOverlapped=0x0) returned 1 [0161.437] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.460] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.471] CloseHandle (hObject=0x110) returned 1 [0161.471] CloseHandle (hObject=0x108) returned 1 [0161.471] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\30666639323932342D663835372D343931652D613265652D6330666532306630643036345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\30666639323932342d663835372d343931652d613265652d6330666532306630643036345b315d.jpg")) returned 0 [0161.472] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\30666639323932342D663835372D343931652D613265652D6330666532306630643036345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\30666639323932342d663835372d343931652d613265652d6330666532306630643036345b315d.jpg")) returned 0x2020 [0161.472] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 0x325098 [0161.472] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 0 [0161.472] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0161.472] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg")) returned 1 [0161.473] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg")) returned 0xffffffff [0161.473] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 1 [0161.474] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0161.474] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.474] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0161.474] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0161.474] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0161.474] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.474] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0161.474] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0161.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0161.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\32363135385B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\32363135385b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0161.476] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc05f [0161.476] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0161.476] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0161.592] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc05f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xc05f, lpOverlapped=0x0) returned 1 [0161.617] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xc060, lpOverlapped=0x0) returned 1 [0161.621] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.644] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.658] CloseHandle (hObject=0x108) returned 1 [0161.658] CloseHandle (hObject=0x110) returned 1 [0161.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\32363135385B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\32363135385b315d.png")) returned 0 [0161.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\32363135385B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\32363135385b315d.png")) returned 0x2020 [0161.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 0x325098 [0161.662] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 0 [0161.662] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0161.662] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png")) returned 1 [0161.663] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png")) returned 0xffffffff [0161.663] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 1 [0161.666] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0161.666] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.669] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0161.669] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0161.669] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0161.669] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.669] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0161.669] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0161.670] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0161.670] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414134327833565B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414134327833565b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0161.671] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3 [0161.671] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0161.671] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0161.749] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3e3, lpOverlapped=0x0) returned 1 [0161.799] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3f0, lpOverlapped=0x0) returned 1 [0161.800] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.822] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.833] CloseHandle (hObject=0x110) returned 1 [0161.834] CloseHandle (hObject=0x108) returned 1 [0161.834] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414134327833565B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414134327833565b315d.png")) returned 0 [0161.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414134327833565B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414134327833565b315d.png")) returned 0x2020 [0161.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 0x325098 [0161.835] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 0 [0161.835] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0161.835] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png")) returned 1 [0161.836] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png")) returned 0xffffffff [0161.836] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 1 [0161.836] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0161.836] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.836] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0161.836] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0161.837] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0161.837] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.837] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b090) returned 0x10ab [0161.837] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0161.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0161.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414135384E516A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414135384e516a5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0161.840] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d0 [0161.840] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0161.841] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0161.873] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1d0, lpOverlapped=0x0) returned 1 [0161.875] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1e0, lpOverlapped=0x0) returned 1 [0161.876] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.899] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.910] CloseHandle (hObject=0x108) returned 1 [0161.910] CloseHandle (hObject=0x110) returned 1 [0161.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414135384E516A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414135384e516a5b315d.png")) returned 0 [0161.911] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414135384E516A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414135384e516a5b315d.png")) returned 0x2020 [0161.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 0x325098 [0161.911] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 0 [0161.911] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0161.911] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png")) returned 1 [0161.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png")) returned 0xffffffff [0161.912] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 1 [0161.913] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0161.913] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.913] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0161.913] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0161.913] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0161.913] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0161.913] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b0) returned 0x10ab [0161.913] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0161.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0161.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414136314F666C5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414136314f666c5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0161.914] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4 [0161.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0161.915] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0161.967] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c4, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1c4, lpOverlapped=0x0) returned 1 [0161.970] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1d0, lpOverlapped=0x0) returned 1 [0161.971] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.994] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.005] CloseHandle (hObject=0x110) returned 1 [0162.005] CloseHandle (hObject=0x108) returned 1 [0162.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414136314F666C5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414136314f666c5b315d.png")) returned 0 [0162.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414136314F666C5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414136314f666c5b315d.png")) returned 0x2020 [0162.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 0x325098 [0162.006] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 0 [0162.006] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0162.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png")) returned 1 [0162.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png")) returned 0xffffffff [0162.007] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 1 [0162.008] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0162.008] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.008] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0162.008] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9d8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0162.008] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.008] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9d8) returned 0x10ab [0162.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0162.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414136534652515B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414136534652515b325d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0162.009] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ed [0162.009] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0162.009] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0162.113] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2ed, lpOverlapped=0x0) returned 1 [0162.115] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2f0, lpOverlapped=0x0) returned 1 [0162.116] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.141] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.154] CloseHandle (hObject=0x108) returned 1 [0162.154] CloseHandle (hObject=0x110) returned 1 [0162.155] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414136534652515B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414136534652515b325d.png")) returned 0 [0162.156] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\414136534652515B325D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\414136534652515b325d.png")) returned 0x2020 [0162.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 0x325098 [0162.156] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 0 [0162.156] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0162.156] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png")) returned 1 [0162.157] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png")) returned 0xffffffff [0162.157] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 1 [0162.158] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0162.158] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.158] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0162.158] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ade8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0162.158] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.158] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ade8) returned 0x10ab [0162.158] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0162.158] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4141613176686D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4141613176686d5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0162.159] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e [0162.159] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0162.159] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0162.244] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x19e, lpOverlapped=0x0) returned 1 [0162.251] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1a0, lpOverlapped=0x0) returned 1 [0162.252] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.275] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.287] CloseHandle (hObject=0x110) returned 1 [0162.287] CloseHandle (hObject=0x108) returned 1 [0162.287] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4141613176686D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4141613176686d5b315d.png")) returned 0 [0162.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4141613176686D5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4141613176686d5b315d.png")) returned 0x2020 [0162.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 0x325098 [0162.288] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 0 [0162.289] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0162.289] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png")) returned 1 [0162.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png")) returned 0xffffffff [0162.290] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 1 [0162.291] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0162.291] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0162.291] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0162.291] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0162.291] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0162.291] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0162.291] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0162.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416131784A465B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416131784a465b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0162.293] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c1 [0162.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0162.293] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0162.384] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2c1, lpOverlapped=0x0) returned 1 [0162.385] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d0, lpOverlapped=0x0) returned 1 [0162.386] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.423] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.434] CloseHandle (hObject=0x108) returned 1 [0162.434] CloseHandle (hObject=0x110) returned 1 [0162.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416131784A465B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416131784a465b315d.png")) returned 0 [0162.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416131784A465B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416131784a465b315d.png")) returned 0x2020 [0162.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 0x325098 [0162.435] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 0 [0162.435] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0162.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png")) returned 1 [0162.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png")) returned 0xffffffff [0162.436] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 1 [0162.437] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0162.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0162.437] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0162.437] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0162.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0162.438] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0162.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0162.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416C473431715B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416c473431715b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0162.439] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b8 [0162.439] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0162.439] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0162.520] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7b8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7b8, lpOverlapped=0x0) returned 1 [0162.522] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7c0, lpOverlapped=0x0) returned 1 [0162.523] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.546] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.556] CloseHandle (hObject=0x110) returned 1 [0162.556] CloseHandle (hObject=0x108) returned 1 [0162.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416C473431715B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416c473431715b315d.jpg")) returned 0 [0162.557] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416C473431715B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416c473431715b315d.jpg")) returned 0x2020 [0162.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 0x325098 [0162.557] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 0 [0162.558] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0162.558] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg")) returned 1 [0162.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg")) returned 0xffffffff [0162.559] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 1 [0162.559] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0162.559] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.559] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0162.559] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0162.559] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b104, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0162.559] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.573] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b104) returned 0x10ab [0162.574] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0162.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0162.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416D696E305A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416d696e305a5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0162.576] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x157 [0162.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0162.576] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0162.665] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x157, lpOverlapped=0x0) returned 1 [0162.667] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x160, lpOverlapped=0x0) returned 1 [0162.668] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.691] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.702] CloseHandle (hObject=0x108) returned 1 [0162.702] CloseHandle (hObject=0x110) returned 1 [0162.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416D696E305A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416d696e305a5b315d.png")) returned 0 [0162.713] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416D696E305A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416d696e305a5b315d.png")) returned 0x2020 [0162.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 0x325098 [0162.713] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 0 [0162.713] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0162.713] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png")) returned 1 [0162.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png")) returned 0xffffffff [0162.714] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 1 [0162.714] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0162.715] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.715] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0162.715] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0162.715] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.715] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9cc) returned 0x10ab [0162.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0162.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416E6852796A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416e6852796a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0162.716] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36b1 [0162.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0162.716] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0162.806] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x36b1, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x36b1, lpOverlapped=0x0) returned 1 [0162.808] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x36c0, lpOverlapped=0x0) returned 1 [0162.809] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.833] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.844] CloseHandle (hObject=0x110) returned 1 [0162.844] CloseHandle (hObject=0x108) returned 1 [0162.845] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416E6852796A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416e6852796a5b315d.jpg")) returned 0 [0162.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\41416E6852796A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\41416e6852796a5b315d.jpg")) returned 0x2020 [0162.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 0x325098 [0162.846] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 0 [0162.846] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0162.846] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg")) returned 1 [0162.847] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg")) returned 0xffffffff [0162.847] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0162.847] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0162.847] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.847] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0162.847] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aeb8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0162.847] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.847] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aeb8) returned 0x10ab [0162.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0162.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6163746976697479693B7372633D323534323131363B6361743D4368726F6D30303B747970653D636C69656E3631323B6F72643D323336363432323433373632315B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6163746976697479693b7372633d323534323131363b6361743d4368726f6d30303b747970653d636c69656e3631323b6f72643d323336363432323433373632315b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0162.849] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39f [0162.849] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0162.849] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0162.941] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x39f, lpOverlapped=0x0) returned 1 [0162.942] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3a0, lpOverlapped=0x0) returned 1 [0162.943] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.967] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.978] CloseHandle (hObject=0x108) returned 1 [0162.978] CloseHandle (hObject=0x110) returned 1 [0162.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6163746976697479693B7372633D323534323131363B6361743D4368726F6D30303B747970653D636C69656E3631323B6F72643D323336363432323433373632315B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6163746976697479693b7372633d323534323131363b6361743d4368726f6d30303b747970653d636c69656e3631323b6f72643d323336363432323433373632315b315d.htm")) returned 0 [0162.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6163746976697479693B7372633D323534323131363B6361743D4368726F6D30303B747970653D636C69656E3631323B6F72643D323336363432323433373632315B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6163746976697479693b7372633d323534323131363b6361743d4368726f6d30303b747970653d636c69656e3631323b6f72643d323336363432323433373632315b315d.htm")) returned 0x2020 [0162.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 0x325098 [0162.979] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 0 [0162.979] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0162.979] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi")) returned 0 [0162.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm")) returned 0x2020 [0162.979] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 1 [0162.980] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0162.980] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.980] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0162.980] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0162.980] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b180, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0162.980] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0162.980] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b180) returned 0x10ab [0162.980] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0162.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0162.981] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\616465785B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\616465785b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0162.982] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91dd [0162.982] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0162.982] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0163.057] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x91dd, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x91dd, lpOverlapped=0x0) returned 1 [0163.080] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x91e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x91e0, lpOverlapped=0x0) returned 1 [0163.082] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.105] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.116] CloseHandle (hObject=0x110) returned 1 [0163.116] CloseHandle (hObject=0x108) returned 1 [0163.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\616465785B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\616465785b315d.js")) returned 0 [0163.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\616465785B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\616465785b315d.js")) returned 0x2020 [0163.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 0x325098 [0163.118] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 0 [0163.118] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0163.118] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js")) returned 1 [0163.119] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js")) returned 0xffffffff [0163.119] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x540e72d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540e72d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x540e72d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0163.120] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0163.120] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.120] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0163.120] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0163.120] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0163.120] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.120] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0163.121] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0163.121] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 1 [0163.121] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0163.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0163.121] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0163.122] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b080, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0163.122] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.122] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b080) returned 0x10ab [0163.122] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0163.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0163.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\616473577261707065724D534E495B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\616473577261707065724d534e495b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0163.123] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x525b [0163.123] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0163.124] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0163.214] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x525b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x525b, lpOverlapped=0x0) returned 1 [0163.225] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5260, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5260, lpOverlapped=0x0) returned 1 [0163.226] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.249] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.259] CloseHandle (hObject=0x108) returned 1 [0163.260] CloseHandle (hObject=0x110) returned 1 [0163.260] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\616473577261707065724D534E495B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\616473577261707065724d534e495b315d.js")) returned 0 [0163.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\616473577261707065724D534E495B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\616473577261707065724d534e495b315d.js")) returned 0x2020 [0163.261] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 0x325098 [0163.261] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 0 [0163.261] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0163.261] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js")) returned 1 [0163.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js")) returned 0xffffffff [0163.262] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 1 [0163.263] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0163.263] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.263] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0163.263] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0163.263] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b080, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0163.263] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.263] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b080) returned 0x10ab [0163.263] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0163.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0163.265] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\61653865393834622D313832302D346138642D393364632D3339326564363536336662365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\61653865393834622d313832302d346138642d393364632d3339326564363536336662365b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0163.266] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8217 [0163.266] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0163.266] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0163.358] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8217, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x8217, lpOverlapped=0x0) returned 1 [0163.360] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8220, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8220, lpOverlapped=0x0) returned 1 [0163.362] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.384] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.403] CloseHandle (hObject=0x110) returned 1 [0163.403] CloseHandle (hObject=0x108) returned 1 [0163.403] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\61653865393834622D313832302D346138642D393364632D3339326564363536336662365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\61653865393834622d313832302d346138642d393364632d3339326564363536336662365b315d.jpg")) returned 0 [0163.404] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\61653865393834622D313832302D346138642D393364632D3339326564363536336662365B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\61653865393834622d313832302d346138642d393364632d3339326564363536336662365b315d.jpg")) returned 0x2020 [0163.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 0x325098 [0163.404] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 0 [0163.404] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0163.404] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg")) returned 1 [0163.405] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg")) returned 0xffffffff [0163.405] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 1 [0163.406] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0163.406] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.406] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0163.406] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0163.406] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.406] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af4c) returned 0x10ab [0163.406] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0163.406] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6173745B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6173745b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0163.407] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1183b [0163.407] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0163.407] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0163.485] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1183b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1183b, lpOverlapped=0x0) returned 1 [0163.490] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11840, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x11840, lpOverlapped=0x0) returned 1 [0163.508] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.532] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.543] CloseHandle (hObject=0x108) returned 1 [0163.543] CloseHandle (hObject=0x110) returned 1 [0163.543] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6173745B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6173745b315d.js")) returned 0 [0163.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6173745B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6173745b315d.js")) returned 0x2020 [0163.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 0x325098 [0163.544] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 0 [0163.544] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0163.544] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js")) returned 1 [0163.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js")) returned 0xffffffff [0163.546] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 1 [0163.547] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0163.547] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.547] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0163.547] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0163.547] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0d8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0163.547] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.547] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0d8) returned 0x10ab [0163.547] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0163.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0163.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6175746F747261636B5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6175746f747261636b5b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0163.550] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a9 [0163.550] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0163.550] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0163.640] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13a9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x13a9, lpOverlapped=0x0) returned 1 [0163.646] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x13b0, lpOverlapped=0x0) returned 1 [0163.647] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.670] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.681] CloseHandle (hObject=0x110) returned 1 [0163.681] CloseHandle (hObject=0x108) returned 1 [0163.681] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6175746F747261636B5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6175746f747261636b5b315d.js")) returned 0 [0163.682] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6175746F747261636B5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6175746f747261636b5b315d.js")) returned 0x2020 [0163.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 0x325098 [0163.682] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 0 [0163.682] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0163.682] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js")) returned 1 [0163.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js")) returned 0xffffffff [0163.700] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 1 [0163.701] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0163.701] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.701] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0163.701] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aeac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0163.701] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.701] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aeac) returned 0x10ab [0163.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0163.703] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242353658546F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242353658546f5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0163.704] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145 [0163.704] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0163.705] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0163.803] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x145, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x145, lpOverlapped=0x0) returned 1 [0163.814] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x150, lpOverlapped=0x0) returned 1 [0163.815] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.838] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.850] CloseHandle (hObject=0x108) returned 1 [0163.850] CloseHandle (hObject=0x110) returned 1 [0163.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242353658546F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242353658546f5b315d.png")) returned 0 [0163.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242353658546F5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242353658546f5b315d.png")) returned 0x2020 [0163.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 0x325098 [0163.851] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 0 [0163.851] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0163.851] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png")) returned 1 [0163.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png")) returned 0xffffffff [0163.852] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 1 [0163.853] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0163.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0163.853] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0163.853] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b094, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0163.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b094) returned 0x10ab [0163.853] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0163.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0163.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424235764F30675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424235764f30675b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0163.855] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b6 [0163.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0163.855] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0163.923] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b6, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1b6, lpOverlapped=0x0) returned 1 [0163.925] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1c0, lpOverlapped=0x0) returned 1 [0163.926] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.948] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.959] CloseHandle (hObject=0x110) returned 1 [0163.960] CloseHandle (hObject=0x108) returned 1 [0163.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424235764F30675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424235764f30675b315d.png")) returned 0 [0163.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424235764F30675B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424235764f30675b315d.png")) returned 0x2020 [0163.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 0x325098 [0163.961] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 0 [0163.961] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0163.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png")) returned 1 [0163.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png")) returned 0xffffffff [0163.962] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 1 [0163.962] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0163.962] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.962] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0163.962] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0163.963] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b104, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0163.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0163.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b104) returned 0x10ab [0163.963] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0163.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0163.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242384164714E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242384164714e5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0163.964] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x156 [0163.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0163.964] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0164.069] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x156, lpOverlapped=0x0) returned 1 [0164.071] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x160, lpOverlapped=0x0) returned 1 [0164.072] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.095] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.107] CloseHandle (hObject=0x108) returned 1 [0164.107] CloseHandle (hObject=0x110) returned 1 [0164.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242384164714E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242384164714e5b315d.png")) returned 0 [0164.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242384164714E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242384164714e5b315d.png")) returned 0x2020 [0164.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 0x325098 [0164.108] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 0 [0164.108] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0164.108] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png")) returned 1 [0164.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png")) returned 0xffffffff [0164.110] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 1 [0164.110] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0164.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0164.110] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa14, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0164.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa14) returned 0x10ab [0164.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0164.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242414C5A79705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242414c5a79705b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0164.112] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152c [0164.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0164.112] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0164.202] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x152c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x152c, lpOverlapped=0x0) returned 1 [0164.209] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1530, lpOverlapped=0x0) returned 1 [0164.210] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.233] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.245] CloseHandle (hObject=0x110) returned 1 [0164.245] CloseHandle (hObject=0x108) returned 1 [0164.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242414C5A79705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242414c5a79705b315d.jpg")) returned 0 [0164.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242414C5A79705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242414c5a79705b315d.jpg")) returned 0x2020 [0164.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 0x325098 [0164.246] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 0 [0164.246] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0164.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg")) returned 1 [0164.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg")) returned 0xffffffff [0164.247] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1 [0164.248] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0164.248] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.248] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0164.248] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae14, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0164.248] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.248] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae14) returned 0x10ab [0164.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0164.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242496D4B705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242496d4b705b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0164.249] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97c [0164.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0164.249] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0164.314] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x97c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x97c, lpOverlapped=0x0) returned 1 [0164.315] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x980, lpOverlapped=0x0) returned 1 [0164.316] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.342] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.352] CloseHandle (hObject=0x108) returned 1 [0164.352] CloseHandle (hObject=0x110) returned 1 [0164.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242496D4B705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242496d4b705b315d.jpg")) returned 0 [0164.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242496D4B705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242496d4b705b315d.jpg")) returned 0x2020 [0164.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0x325098 [0164.354] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0 [0164.354] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0164.354] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg")) returned 1 [0164.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg")) returned 0xffffffff [0164.355] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 1 [0164.355] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0164.355] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.355] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0164.355] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0164.356] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0164.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0164.356] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0164.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0164.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D474A6F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d474a6f5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0164.357] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29ca [0164.357] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0164.357] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0164.462] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29ca, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x29ca, lpOverlapped=0x0) returned 1 [0164.470] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x29d0, lpOverlapped=0x0) returned 1 [0164.471] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.494] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.505] CloseHandle (hObject=0x110) returned 1 [0164.505] CloseHandle (hObject=0x108) returned 1 [0164.506] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D474A6F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d474a6f5b315d.jpg")) returned 0 [0164.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D474A6F5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d474a6f5b315d.jpg")) returned 0x2020 [0164.507] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 0x325098 [0164.507] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 0 [0164.507] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0164.507] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg")) returned 1 [0164.508] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg")) returned 0xffffffff [0164.508] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 1 [0164.508] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0164.509] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.509] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0164.509] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0164.509] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0164.509] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.509] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0164.509] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0164.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0164.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D4B44465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d4b44465b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0164.510] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x862 [0164.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0164.511] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0164.619] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x862, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x862, lpOverlapped=0x0) returned 1 [0164.656] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x870, lpOverlapped=0x0) returned 1 [0164.657] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.679] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.690] CloseHandle (hObject=0x108) returned 1 [0164.690] CloseHandle (hObject=0x110) returned 1 [0164.690] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D4B44465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d4b44465b315d.jpg")) returned 0 [0164.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D4B44465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d4b44465b315d.jpg")) returned 0x2020 [0164.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 0x325098 [0164.691] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 0 [0164.691] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0164.691] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg")) returned 1 [0164.692] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg")) returned 0xffffffff [0164.692] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 1 [0164.693] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0164.693] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.693] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0164.693] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0164.693] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b084, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0164.693] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.693] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b084) returned 0x10ab [0164.693] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0164.694] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0164.694] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D5163685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d5163685b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0164.696] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142e [0164.696] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0164.697] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0164.730] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x142e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x142e, lpOverlapped=0x0) returned 1 [0164.732] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1430, lpOverlapped=0x0) returned 1 [0164.733] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.755] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.767] CloseHandle (hObject=0x110) returned 1 [0164.767] CloseHandle (hObject=0x108) returned 1 [0164.767] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D5163685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d5163685b315d.jpg")) returned 0 [0164.768] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D5163685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d5163685b315d.jpg")) returned 0x2020 [0164.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 0x325098 [0164.768] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 0 [0164.768] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0164.768] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg")) returned 1 [0164.769] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg")) returned 0xffffffff [0164.769] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 1 [0164.769] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0164.769] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.769] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0164.769] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abe8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0164.769] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.769] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abe8) returned 0x10ab [0164.770] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0164.770] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D7956685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d7956685b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0164.771] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e6b [0164.771] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0164.771] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0164.815] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e6b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3e6b, lpOverlapped=0x0) returned 1 [0164.842] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3e70, lpOverlapped=0x0) returned 1 [0164.843] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.865] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.876] CloseHandle (hObject=0x108) returned 1 [0164.876] CloseHandle (hObject=0x110) returned 1 [0164.876] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D7956685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d7956685b315d.jpg")) returned 0 [0164.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424D7956685B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424d7956685b315d.jpg")) returned 0x2020 [0164.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 0x325098 [0164.878] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 0 [0164.878] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0164.878] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg")) returned 1 [0164.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg")) returned 0xffffffff [0164.879] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 1 [0164.879] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0164.879] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.879] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0164.879] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0164.880] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0164.880] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.880] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0164.880] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0164.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0164.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424E4166375B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424e4166375b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0164.881] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x812 [0164.881] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0164.881] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0164.916] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x812, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x812, lpOverlapped=0x0) returned 1 [0164.927] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x820, lpOverlapped=0x0) returned 1 [0164.933] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.956] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.971] CloseHandle (hObject=0x110) returned 1 [0164.971] CloseHandle (hObject=0x108) returned 1 [0164.974] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424E4166375B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424e4166375b315d.jpg")) returned 0 [0164.975] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424E4166375B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424e4166375b315d.jpg")) returned 0x2020 [0164.975] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 0x325098 [0164.975] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 0 [0164.975] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0164.975] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg")) returned 1 [0164.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg")) returned 0xffffffff [0164.976] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 1 [0164.979] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0164.979] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.982] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0164.982] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0164.982] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0164.982] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0164.982] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0164.982] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0164.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0164.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424E6E54465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424e6e54465b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0164.983] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb22 [0164.983] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0164.984] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0165.070] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb22, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xb22, lpOverlapped=0x0) returned 1 [0165.071] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb30, lpOverlapped=0x0) returned 1 [0165.072] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.094] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.105] CloseHandle (hObject=0x108) returned 1 [0165.106] CloseHandle (hObject=0x110) returned 1 [0165.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424E6E54465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424e6e54465b315d.jpg")) returned 0 [0165.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424E6E54465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424e6e54465b315d.jpg")) returned 0x2020 [0165.107] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 0x325098 [0165.107] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 0 [0165.107] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0165.107] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg")) returned 1 [0165.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg")) returned 0xffffffff [0165.108] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 1 [0165.109] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0165.109] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0165.110] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a944, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0165.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a944) returned 0x10ab [0165.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0165.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F34645A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f34645a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0165.111] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1529 [0165.111] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0165.111] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0165.201] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1529, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1529, lpOverlapped=0x0) returned 1 [0165.202] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1530, lpOverlapped=0x0) returned 1 [0165.203] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.226] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.237] CloseHandle (hObject=0x110) returned 1 [0165.237] CloseHandle (hObject=0x108) returned 1 [0165.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F34645A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f34645a5b315d.jpg")) returned 0 [0165.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F34645A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f34645a5b315d.jpg")) returned 0x2020 [0165.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 0x325098 [0165.239] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 0 [0165.239] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0165.239] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg")) returned 1 [0165.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg")) returned 0xffffffff [0165.240] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 1 [0165.240] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0165.240] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.240] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0165.240] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac20, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0165.240] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.240] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac20) returned 0x10ab [0165.240] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0165.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F386F775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f386f775b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0165.242] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e61 [0165.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0165.242] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0165.338] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e61, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1e61, lpOverlapped=0x0) returned 1 [0165.339] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1e70, lpOverlapped=0x0) returned 1 [0165.341] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.364] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.375] CloseHandle (hObject=0x108) returned 1 [0165.375] CloseHandle (hObject=0x110) returned 1 [0165.375] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F386F775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f386f775b315d.jpg")) returned 0 [0165.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F386F775B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f386f775b315d.jpg")) returned 0x2020 [0165.376] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 0x325098 [0165.376] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 0 [0165.376] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0165.376] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg")) returned 1 [0165.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg")) returned 0xffffffff [0165.378] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 1 [0165.378] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0165.378] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.378] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0165.378] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0165.378] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0165.379] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.379] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0165.379] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0165.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6165535B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6165535b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0165.380] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x636 [0165.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0165.380] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0165.471] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x636, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x636, lpOverlapped=0x0) returned 1 [0165.472] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x640, lpOverlapped=0x0) returned 1 [0165.473] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.496] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.507] CloseHandle (hObject=0x110) returned 1 [0165.507] CloseHandle (hObject=0x108) returned 1 [0165.507] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6165535B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6165535b315d.jpg")) returned 0 [0165.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6165535B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6165535b315d.jpg")) returned 0x2020 [0165.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 0x325098 [0165.509] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 0 [0165.509] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0165.509] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg")) returned 1 [0165.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg")) returned 0xffffffff [0165.510] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 1 [0165.511] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0165.511] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.511] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0165.511] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0165.511] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0165.511] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.511] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0165.511] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0165.512] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6349625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6349625b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0165.512] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82a [0165.512] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0165.513] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0165.602] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x82a, lpOverlapped=0x0) returned 1 [0165.624] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x830, lpOverlapped=0x0) returned 1 [0165.625] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.648] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.659] CloseHandle (hObject=0x108) returned 1 [0165.659] CloseHandle (hObject=0x110) returned 1 [0165.659] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6349625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6349625b315d.jpg")) returned 0 [0165.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6349625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6349625b315d.jpg")) returned 0x2020 [0165.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 0x325098 [0165.660] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 0 [0165.661] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0165.661] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg")) returned 1 [0165.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg")) returned 0xffffffff [0165.662] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 1 [0165.662] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0165.662] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.662] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0165.662] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0165.663] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0165.663] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.663] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b090) returned 0x10ab [0165.663] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0165.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6464705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6464705b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0165.664] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161e [0165.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0165.665] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0165.753] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x161e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x161e, lpOverlapped=0x0) returned 1 [0165.800] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1620, lpOverlapped=0x0) returned 1 [0165.801] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.824] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.835] CloseHandle (hObject=0x110) returned 1 [0165.835] CloseHandle (hObject=0x108) returned 1 [0165.835] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6464705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6464705b315d.jpg")) returned 0 [0165.837] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6464705B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6464705b315d.jpg")) returned 0x2020 [0165.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 0x325098 [0165.837] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 0 [0165.837] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0165.837] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg")) returned 1 [0165.838] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg")) returned 0xffffffff [0165.838] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 1 [0165.838] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0165.838] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.838] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0165.838] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0165.839] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0165.839] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.839] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b090) returned 0x10ab [0165.839] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.839] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0165.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6D61725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6d61725b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0165.841] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5685 [0165.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0165.841] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0165.874] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5685, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x5685, lpOverlapped=0x0) returned 1 [0165.883] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5690, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5690, lpOverlapped=0x0) returned 1 [0165.884] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.907] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.920] CloseHandle (hObject=0x108) returned 1 [0165.920] CloseHandle (hObject=0x110) returned 1 [0165.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6D61725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6d61725b315d.jpg")) returned 0 [0165.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242424F6D61725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242424f6d61725b315d.jpg")) returned 0x2020 [0165.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 0x325098 [0165.921] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 0 [0165.921] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0165.921] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg")) returned 1 [0165.922] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg")) returned 0xffffffff [0165.922] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 1 [0165.922] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0165.922] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.922] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0165.922] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aca4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0165.922] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0165.923] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aca4) returned 0x10ab [0165.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0165.924] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242523479515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242523479515b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0165.924] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f6b [0165.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0165.925] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0165.957] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2f6b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2f6b, lpOverlapped=0x0) returned 1 [0165.978] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2f70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2f70, lpOverlapped=0x0) returned 1 [0165.979] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.002] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.013] CloseHandle (hObject=0x110) returned 1 [0166.013] CloseHandle (hObject=0x108) returned 1 [0166.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242523479515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242523479515b315d.jpg")) returned 0 [0166.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242523479515B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242523479515b315d.jpg")) returned 0x2020 [0166.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 0x325098 [0166.014] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 0 [0166.014] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0166.014] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg")) returned 1 [0166.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg")) returned 0xffffffff [0166.016] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 1 [0166.016] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0166.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.016] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0166.016] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0166.016] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afc8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0166.017] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afc8) returned 0x10ab [0166.017] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0166.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242425550616A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242425550616a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0166.018] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x264b [0166.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0166.018] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0166.055] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x264b, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x264b, lpOverlapped=0x0) returned 1 [0166.059] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2650, lpOverlapped=0x0) returned 1 [0166.060] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.083] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.094] CloseHandle (hObject=0x108) returned 1 [0166.094] CloseHandle (hObject=0x110) returned 1 [0166.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242425550616A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242425550616a5b315d.jpg")) returned 0 [0166.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242425550616A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242425550616a5b315d.jpg")) returned 0x2020 [0166.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 0x325098 [0166.096] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 0 [0166.096] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0166.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg")) returned 1 [0166.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg")) returned 0xffffffff [0166.097] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1 [0166.097] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0166.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.097] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0166.097] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0166.098] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0166.098] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.098] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0166.098] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0166.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424256454F575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424256454f575b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0166.099] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e08 [0166.099] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0166.099] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0166.180] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e08, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3e08, lpOverlapped=0x0) returned 1 [0166.191] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3e10, lpOverlapped=0x0) returned 1 [0166.192] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.215] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.225] CloseHandle (hObject=0x110) returned 1 [0166.225] CloseHandle (hObject=0x108) returned 1 [0166.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424256454F575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424256454f575b315d.jpg")) returned 0 [0166.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424256454F575B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424256454f575b315d.jpg")) returned 0x2020 [0166.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0x325098 [0166.227] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0 [0166.227] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0166.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg")) returned 1 [0166.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg")) returned 0xffffffff [0166.228] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 1 [0166.228] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0166.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0166.229] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0166.229] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b100, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0166.229] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b100) returned 0x10ab [0166.229] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0166.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242564C63475B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242564c63475b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0166.230] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1f [0166.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0166.231] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0166.297] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa1f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xa1f, lpOverlapped=0x0) returned 1 [0166.305] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xa20, lpOverlapped=0x0) returned 1 [0166.306] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.329] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.340] CloseHandle (hObject=0x108) returned 1 [0166.340] CloseHandle (hObject=0x110) returned 1 [0166.340] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242564C63475B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242564c63475b315d.jpg")) returned 0 [0166.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242564C63475B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242564c63475b315d.jpg")) returned 0x2020 [0166.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 0x325098 [0166.341] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 0 [0166.341] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0166.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg")) returned 1 [0166.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg")) returned 0xffffffff [0166.342] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 1 [0166.343] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0166.343] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.343] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0166.343] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0166.343] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0166.343] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.343] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0166.343] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0166.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424256536B505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424256536b505b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0166.344] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82d [0166.344] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0166.345] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0166.438] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x82d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x82d, lpOverlapped=0x0) returned 1 [0166.439] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x830, lpOverlapped=0x0) returned 1 [0166.440] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.463] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.474] CloseHandle (hObject=0x110) returned 1 [0166.474] CloseHandle (hObject=0x108) returned 1 [0166.474] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424256536B505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424256536b505b315d.jpg")) returned 0 [0166.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424256536B505B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424256536b505b315d.jpg")) returned 0x2020 [0166.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 0x325098 [0166.476] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 0 [0166.476] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0166.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg")) returned 1 [0166.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg")) returned 0xffffffff [0166.477] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1 [0166.478] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0166.478] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.478] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0166.478] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0166.478] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.478] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e4) returned 0x10ab [0166.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0166.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242596645485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242596645485b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0166.479] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f5 [0166.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0166.480] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0166.573] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16f5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x16f5, lpOverlapped=0x0) returned 1 [0166.575] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1700, lpOverlapped=0x0) returned 1 [0166.576] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.599] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.610] CloseHandle (hObject=0x108) returned 1 [0166.610] CloseHandle (hObject=0x110) returned 1 [0166.611] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242596645485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242596645485b315d.jpg")) returned 0 [0166.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424242596645485B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424242596645485b315d.jpg")) returned 0x2020 [0166.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0x325098 [0166.612] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0 [0166.612] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0166.612] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg")) returned 1 [0166.613] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg")) returned 0xffffffff [0166.613] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 1 [0166.613] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0166.613] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.613] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0166.613] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0166.613] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.613] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad0c) returned 0x10ab [0166.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0166.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242425A3576545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242425a3576545b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0166.615] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc20 [0166.615] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0166.615] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0166.697] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xc20, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xc30, lpOverlapped=0x0) returned 1 [0166.699] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.722] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.733] CloseHandle (hObject=0x110) returned 1 [0166.733] CloseHandle (hObject=0x108) returned 1 [0166.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242425A3576545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242425a3576545b315d.jpg")) returned 0 [0166.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242425A3576545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242425a3576545b315d.jpg")) returned 0x2020 [0166.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 0x325098 [0166.734] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 0 [0166.734] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0166.734] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg")) returned 1 [0166.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg")) returned 0xffffffff [0166.735] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 1 [0166.735] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0166.735] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.735] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0166.735] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0166.736] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0166.736] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.736] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0166.736] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0166.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303247725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303247725b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0166.737] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86e [0166.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0166.737] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0166.826] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x86e, lpOverlapped=0x0) returned 1 [0166.831] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x870, lpOverlapped=0x0) returned 1 [0166.833] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.857] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.868] CloseHandle (hObject=0x108) returned 1 [0166.868] CloseHandle (hObject=0x110) returned 1 [0166.869] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303247725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303247725b315d.jpg")) returned 0 [0166.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303247725B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303247725b315d.jpg")) returned 0x2020 [0166.870] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 0x325098 [0166.870] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 0 [0166.870] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0166.870] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg")) returned 1 [0166.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg")) returned 0xffffffff [0166.871] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 1 [0166.872] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0166.872] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.872] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0166.872] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af34, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0166.872] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0166.872] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af34) returned 0x10ab [0166.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0166.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303247725B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303247725b325d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0166.873] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86e [0166.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0166.873] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0166.964] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x86e, lpOverlapped=0x0) returned 1 [0166.965] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x870, lpOverlapped=0x0) returned 1 [0166.966] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.989] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.000] CloseHandle (hObject=0x110) returned 1 [0167.001] CloseHandle (hObject=0x108) returned 1 [0167.004] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303247725B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303247725b325d.jpg")) returned 0 [0167.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303247725B325D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303247725b325d.jpg")) returned 0x2020 [0167.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 0x325098 [0167.005] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 0 [0167.005] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0167.005] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg")) returned 1 [0167.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg")) returned 0xffffffff [0167.006] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1 [0167.007] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0167.007] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.007] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0167.007] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0167.007] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0167.007] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.007] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a8) returned 0x10ab [0167.007] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0167.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0167.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303342315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303342315b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0167.008] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89a [0167.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0167.009] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0167.099] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x89a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x89a, lpOverlapped=0x0) returned 1 [0167.100] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8a0, lpOverlapped=0x0) returned 1 [0167.101] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.124] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.135] CloseHandle (hObject=0x108) returned 1 [0167.135] CloseHandle (hObject=0x110) returned 1 [0167.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303342315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303342315b315d.jpg")) returned 0 [0167.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303342315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303342315b315d.jpg")) returned 0x2020 [0167.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0x325098 [0167.136] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0 [0167.136] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0167.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg")) returned 1 [0167.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg")) returned 0xffffffff [0167.137] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1 [0167.138] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0167.138] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.138] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0167.138] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0167.138] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0167.138] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.138] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0167.138] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0167.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0167.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303655625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303655625b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0167.139] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7bb [0167.139] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0167.140] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0167.214] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7bb, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7bb, lpOverlapped=0x0) returned 1 [0167.222] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7c0, lpOverlapped=0x0) returned 1 [0167.224] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.254] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.265] CloseHandle (hObject=0x110) returned 1 [0167.266] CloseHandle (hObject=0x108) returned 1 [0167.266] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303655625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303655625b315d.jpg")) returned 0 [0167.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243303655625B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243303655625b315d.jpg")) returned 0x2020 [0167.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0x325098 [0167.268] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0 [0167.268] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0167.268] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg")) returned 1 [0167.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg")) returned 0xffffffff [0167.269] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 1 [0167.270] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0167.270] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.270] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0167.270] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0167.270] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0167.270] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.270] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0167.271] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0167.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0167.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424330446A675B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424330446a675b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0167.273] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ab [0167.273] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0167.273] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0167.365] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9ab, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9ab, lpOverlapped=0x0) returned 1 [0167.368] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9b0, lpOverlapped=0x0) returned 1 [0167.369] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.414] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.425] CloseHandle (hObject=0x108) returned 1 [0167.425] CloseHandle (hObject=0x110) returned 1 [0167.425] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424330446A675B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424330446a675b315d.jpg")) returned 0 [0167.426] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424330446A675B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424330446a675b315d.jpg")) returned 0x2020 [0167.426] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 0x325098 [0167.426] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 0 [0167.426] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0167.426] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg")) returned 1 [0167.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg")) returned 0xffffffff [0167.428] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1 [0167.428] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0167.428] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.428] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0167.428] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0167.428] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.428] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac74) returned 0x10ab [0167.428] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0167.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306737615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306737615b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0167.430] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fd [0167.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0167.430] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0167.507] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7fd, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7fd, lpOverlapped=0x0) returned 1 [0167.509] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x800, lpOverlapped=0x0) returned 1 [0167.510] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.533] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.544] CloseHandle (hObject=0x110) returned 1 [0167.544] CloseHandle (hObject=0x108) returned 1 [0167.544] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306737615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306737615b315d.jpg")) returned 0 [0167.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306737615B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306737615b315d.jpg")) returned 0x2020 [0167.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0x325098 [0167.545] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0 [0167.545] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0167.545] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg")) returned 1 [0167.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg")) returned 0xffffffff [0167.546] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 1 [0167.546] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0167.546] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.546] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0167.547] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0167.547] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0167.547] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.547] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afb4) returned 0x10ab [0167.547] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0167.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0167.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306C66325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306c66325b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0167.549] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82f [0167.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0167.549] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0167.681] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x82f, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x82f, lpOverlapped=0x0) returned 1 [0167.683] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x830, lpOverlapped=0x0) returned 1 [0167.684] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.706] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.717] CloseHandle (hObject=0x108) returned 1 [0167.717] CloseHandle (hObject=0x110) returned 1 [0167.717] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306C66325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306c66325b315d.jpg")) returned 0 [0167.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306C66325B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306c66325b315d.jpg")) returned 0x2020 [0167.718] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 0x325098 [0167.718] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 0 [0167.718] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0167.718] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg")) returned 1 [0167.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg")) returned 0xffffffff [0167.719] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1 [0167.720] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0167.720] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.720] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0167.720] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0167.720] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0167.721] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.721] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0167.721] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0167.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0167.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306D4B315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306d4b315b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0167.722] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afe [0167.722] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0167.722] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0167.811] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1afe, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1afe, lpOverlapped=0x0) returned 1 [0167.813] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1b00, lpOverlapped=0x0) returned 1 [0167.814] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.838] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.850] CloseHandle (hObject=0x110) returned 1 [0167.850] CloseHandle (hObject=0x108) returned 1 [0167.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306D4B315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306d4b315b315d.jpg")) returned 0 [0167.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424243306D4B315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424243306d4b315b315d.jpg")) returned 0x2020 [0167.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0x325098 [0167.851] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0 [0167.851] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0167.851] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg")) returned 1 [0167.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg")) returned 0xffffffff [0167.852] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 1 [0167.853] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0167.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0167.853] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0167.853] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0167.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0167.853] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0167.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0167.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424330716C425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424330716c425b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0167.854] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fc3 [0167.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0167.855] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0167.929] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1fc3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1fc3, lpOverlapped=0x0) returned 1 [0167.931] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1fd0, lpOverlapped=0x0) returned 1 [0167.932] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.955] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.967] CloseHandle (hObject=0x108) returned 1 [0167.967] CloseHandle (hObject=0x110) returned 1 [0167.967] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424330716C425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424330716c425b315d.jpg")) returned 0 [0167.968] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424330716C425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424330716c425b315d.jpg")) returned 0x2020 [0167.968] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 0x325098 [0167.968] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 0 [0167.968] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0167.968] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg")) returned 1 [0167.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg")) returned 0xffffffff [0167.969] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 1 [0167.969] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0167.970] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.970] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0167.970] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0167.970] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0167.970] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0167.970] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0167.970] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0167.970] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0167.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245374B505A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245374b505a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0167.971] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ecb [0167.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0167.972] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0168.072] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2ecb, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2ecb, lpOverlapped=0x0) returned 1 [0168.074] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2ed0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2ed0, lpOverlapped=0x0) returned 1 [0168.076] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.099] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.109] CloseHandle (hObject=0x110) returned 1 [0168.109] CloseHandle (hObject=0x108) returned 1 [0168.110] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245374B505A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245374b505a5b315d.jpg")) returned 0 [0168.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245374B505A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245374b505a5b315d.jpg")) returned 0x2020 [0168.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 0x325098 [0168.111] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 0 [0168.111] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0168.111] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg")) returned 1 [0168.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg")) returned 0xffffffff [0168.112] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 1 [0168.113] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0168.113] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.113] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0168.113] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abcc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0168.113] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.113] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abcc) returned 0x10ab [0168.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0168.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424538496C415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424538496c415b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0168.115] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9c5 [0168.115] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0168.115] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0168.205] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9c5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9c5, lpOverlapped=0x0) returned 1 [0168.207] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9d0, lpOverlapped=0x0) returned 1 [0168.208] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.230] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.242] CloseHandle (hObject=0x108) returned 1 [0168.242] CloseHandle (hObject=0x110) returned 1 [0168.242] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424538496C415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424538496c415b315d.jpg")) returned 0 [0168.243] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424538496C415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424538496c415b315d.jpg")) returned 0x2020 [0168.243] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 0x325098 [0168.243] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 0 [0168.243] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0168.243] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg")) returned 1 [0168.244] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg")) returned 0xffffffff [0168.244] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 1 [0168.244] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0168.244] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.244] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0168.244] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0168.245] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0168.245] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.245] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0168.245] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0168.245] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0168.245] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245393732465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245393732465b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0168.246] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2669 [0168.246] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0168.246] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0168.336] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2669, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2669, lpOverlapped=0x0) returned 1 [0168.338] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2670, lpOverlapped=0x0) returned 1 [0168.339] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.361] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.372] CloseHandle (hObject=0x110) returned 1 [0168.373] CloseHandle (hObject=0x108) returned 1 [0168.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245393732465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245393732465b315d.jpg")) returned 0 [0168.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245393732465B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245393732465b315d.jpg")) returned 0x2020 [0168.374] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 0x325098 [0168.374] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 0 [0168.374] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0168.374] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg")) returned 1 [0168.375] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg")) returned 0xffffffff [0168.375] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 1 [0168.375] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0168.375] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.375] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0168.375] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0168.376] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0168.376] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.376] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0168.376] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0168.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0168.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245397464785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245397464785b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0168.377] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a77 [0168.377] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0168.377] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0168.464] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2a77, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2a77, lpOverlapped=0x0) returned 1 [0168.466] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2a80, lpOverlapped=0x0) returned 1 [0168.467] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.492] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.504] CloseHandle (hObject=0x108) returned 1 [0168.504] CloseHandle (hObject=0x110) returned 1 [0168.504] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245397464785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245397464785b315d.jpg")) returned 0 [0168.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245397464785B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245397464785b315d.jpg")) returned 0x2020 [0168.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 0x325098 [0168.505] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 0 [0168.505] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0168.505] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg")) returned 1 [0168.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg")) returned 0xffffffff [0168.506] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 1 [0168.507] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0168.507] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.507] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0168.507] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0168.507] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0168.507] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.507] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0168.507] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0168.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0168.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245647271745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245647271745b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0168.508] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fe3 [0168.508] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0168.509] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0168.612] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2fe3, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2fe3, lpOverlapped=0x0) returned 1 [0168.614] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2ff0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2ff0, lpOverlapped=0x0) returned 1 [0168.618] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.640] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.663] CloseHandle (hObject=0x110) returned 1 [0168.663] CloseHandle (hObject=0x108) returned 1 [0168.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245647271745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245647271745b315d.jpg")) returned 0 [0168.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245647271745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245647271745b315d.jpg")) returned 0x2020 [0168.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 0x325098 [0168.667] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 0 [0168.667] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0168.667] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg")) returned 1 [0168.668] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg")) returned 0xffffffff [0168.668] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 1 [0168.671] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0168.671] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.674] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0168.674] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0168.674] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0168.674] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.674] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0168.674] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0168.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0168.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654577745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654577745b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0168.676] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x857 [0168.676] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0168.676] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0168.767] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x857, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x857, lpOverlapped=0x0) returned 1 [0168.769] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x860, lpOverlapped=0x0) returned 1 [0168.770] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.792] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.803] CloseHandle (hObject=0x108) returned 1 [0168.803] CloseHandle (hObject=0x110) returned 1 [0168.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654577745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654577745b315d.jpg")) returned 0 [0168.804] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654577745B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654577745b315d.jpg")) returned 0x2020 [0168.804] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 0x325098 [0168.804] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 0 [0168.804] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0168.804] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg")) returned 1 [0168.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg")) returned 0xffffffff [0168.805] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 1 [0168.805] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0168.805] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.805] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0168.805] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aca4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0168.806] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.806] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aca4) returned 0x10ab [0168.806] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0168.806] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245656973335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245656973335b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0168.807] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d9 [0168.807] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0168.807] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0168.884] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7d9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x7d9, lpOverlapped=0x0) returned 1 [0168.886] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x7e0, lpOverlapped=0x0) returned 1 [0168.887] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.909] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.920] CloseHandle (hObject=0x110) returned 1 [0168.920] CloseHandle (hObject=0x108) returned 1 [0168.921] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245656973335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245656973335b315d.jpg")) returned 0 [0168.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245656973335B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245656973335b315d.jpg")) returned 0x2020 [0168.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 0x325098 [0168.921] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 0 [0168.921] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0168.922] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg")) returned 1 [0168.922] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg")) returned 0xffffffff [0168.922] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 1 [0168.923] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0168.923] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.923] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0168.923] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0168.923] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afc8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0168.923] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0168.923] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afc8) returned 0x10ab [0168.923] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0168.924] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0168.924] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654B76565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654b76565b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0168.925] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c5 [0168.925] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0168.925] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0169.011] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8c5, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x8c5, lpOverlapped=0x0) returned 1 [0169.017] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x8d0, lpOverlapped=0x0) returned 1 [0169.018] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.040] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.051] CloseHandle (hObject=0x108) returned 1 [0169.051] CloseHandle (hObject=0x110) returned 1 [0169.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654B76565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654b76565b315d.jpg")) returned 0 [0169.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654B76565B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654b76565b315d.jpg")) returned 0x2020 [0169.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 0x325098 [0169.052] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 0 [0169.052] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0169.052] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg")) returned 1 [0169.053] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg")) returned 0xffffffff [0169.053] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 1 [0169.054] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0169.054] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.054] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0169.054] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0169.054] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0169.054] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.054] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0169.054] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0169.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0169.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654E64385B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654e64385b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0169.055] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef00 [0169.056] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0169.056] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0169.143] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xef00, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xef00, lpOverlapped=0x0) returned 1 [0169.146] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xef10, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xef10, lpOverlapped=0x0) returned 1 [0169.148] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.170] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.181] CloseHandle (hObject=0x110) returned 1 [0169.181] CloseHandle (hObject=0x108) returned 1 [0169.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654E64385B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654e64385b315d.png")) returned 0 [0169.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245654E64385B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245654e64385b315d.png")) returned 0x2020 [0169.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 0x325098 [0169.182] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 0 [0169.182] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0169.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png")) returned 1 [0169.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png")) returned 0xffffffff [0169.184] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 1 [0169.184] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0169.184] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.184] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0169.184] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0169.185] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b100, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0169.185] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.185] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b100) returned 0x10ab [0169.185] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0169.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0169.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424565775A425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424565775a425b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0169.186] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3323 [0169.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0169.186] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0169.274] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3323, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3323, lpOverlapped=0x0) returned 1 [0169.277] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3330, lpOverlapped=0x0) returned 1 [0169.278] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.301] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.311] CloseHandle (hObject=0x108) returned 1 [0169.311] CloseHandle (hObject=0x110) returned 1 [0169.312] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424565775A425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424565775a425b315d.jpg")) returned 0 [0169.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424565775A425B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424565775a425b315d.jpg")) returned 0x2020 [0169.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 0x325098 [0169.313] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 0 [0169.313] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0169.313] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg")) returned 1 [0169.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg")) returned 0xffffffff [0169.314] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 1 [0169.318] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0169.318] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.318] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0169.318] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0169.318] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0169.318] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.318] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0169.318] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0169.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0169.319] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245655A306B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245655a306b5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0169.319] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d7 [0169.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0169.320] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0169.411] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9d7, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x9d7, lpOverlapped=0x0) returned 1 [0169.413] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x9e0, lpOverlapped=0x0) returned 1 [0169.414] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.436] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.447] CloseHandle (hObject=0x110) returned 1 [0169.447] CloseHandle (hObject=0x108) returned 1 [0169.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245655A306B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245655a306b5b315d.jpg")) returned 0 [0169.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245655A306B5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245655a306b5b315d.jpg")) returned 0x2020 [0169.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 0x325098 [0169.448] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 0 [0169.448] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0169.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg")) returned 1 [0169.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg")) returned 0xffffffff [0169.450] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 1 [0169.450] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0169.450] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.451] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0169.451] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0169.451] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.451] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9e4) returned 0x10ab [0169.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0169.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245663673345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245663673345b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0169.452] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d32 [0169.452] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0169.452] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0169.524] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d32, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2d32, lpOverlapped=0x0) returned 1 [0169.531] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d40, lpOverlapped=0x0) returned 1 [0169.532] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.554] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.565] CloseHandle (hObject=0x108) returned 1 [0169.565] CloseHandle (hObject=0x110) returned 1 [0169.566] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245663673345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245663673345b315d.jpg")) returned 0 [0169.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245663673345B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245663673345b315d.jpg")) returned 0x2020 [0169.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 0x325098 [0169.567] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 0 [0169.567] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0169.567] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg")) returned 1 [0169.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg")) returned 0xffffffff [0169.568] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 1 [0169.568] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0169.568] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.569] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0169.569] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0169.569] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.569] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad0c) returned 0x10ab [0169.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0169.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245664163355B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245664163355b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0169.570] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d [0169.570] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0169.570] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0169.674] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x85d, lpOverlapped=0x0) returned 1 [0169.676] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x860, lpOverlapped=0x0) returned 1 [0169.677] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.699] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.710] CloseHandle (hObject=0x110) returned 1 [0169.710] CloseHandle (hObject=0x108) returned 1 [0169.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245664163355B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245664163355b315d.jpg")) returned 0 [0169.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245664163355B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245664163355b315d.jpg")) returned 0x2020 [0169.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 0x325098 [0169.711] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 0 [0169.711] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0169.711] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg")) returned 1 [0169.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg")) returned 0xffffffff [0169.712] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 1 [0169.713] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0169.713] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.713] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0169.713] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0169.713] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0169.713] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.713] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0169.713] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0169.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0169.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666744695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666744695b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0169.714] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197c [0169.714] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0169.715] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0169.801] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x197c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x197c, lpOverlapped=0x0) returned 1 [0169.803] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1980, lpOverlapped=0x0) returned 1 [0169.804] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.826] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.837] CloseHandle (hObject=0x108) returned 1 [0169.837] CloseHandle (hObject=0x110) returned 1 [0169.837] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666744695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666744695b315d.jpg")) returned 0 [0169.838] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666744695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666744695b315d.jpg")) returned 0x2020 [0169.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 0x325098 [0169.838] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 0 [0169.838] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0169.838] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg")) returned 1 [0169.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg")) returned 0xffffffff [0169.839] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1 [0169.840] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0169.840] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.840] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0169.840] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af34, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0169.840] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.840] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af34) returned 0x10ab [0169.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0169.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666A75545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666a75545b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0169.841] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7e [0169.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0169.841] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0169.930] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb7e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xb7e, lpOverlapped=0x0) returned 1 [0169.941] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb80, lpOverlapped=0x0) returned 1 [0169.942] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.965] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.976] CloseHandle (hObject=0x110) returned 1 [0169.976] CloseHandle (hObject=0x108) returned 1 [0169.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666A75545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666a75545b315d.jpg")) returned 0 [0169.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666A75545B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666a75545b315d.jpg")) returned 0x2020 [0169.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0x325098 [0169.977] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0 [0169.977] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0169.977] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg")) returned 1 [0169.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg")) returned 0xffffffff [0169.978] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 1 [0169.979] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0169.979] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.979] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0169.979] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0169.979] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0169.979] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0169.979] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a8) returned 0x10ab [0169.979] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0169.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0169.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666B67695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666b67695b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0169.980] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b14 [0169.980] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0169.981] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0170.055] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b14, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1b14, lpOverlapped=0x0) returned 1 [0170.063] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1b20, lpOverlapped=0x0) returned 1 [0170.064] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.086] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.098] CloseHandle (hObject=0x108) returned 1 [0170.098] CloseHandle (hObject=0x110) returned 1 [0170.098] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666B67695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666b67695b315d.jpg")) returned 0 [0170.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245666B67695B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245666b67695b315d.jpg")) returned 0x2020 [0170.099] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 0x325098 [0170.099] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 0 [0170.099] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0170.099] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg")) returned 1 [0170.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg")) returned 0xffffffff [0170.100] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 1 [0170.101] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0170.101] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.101] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0170.101] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0170.101] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0170.101] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.101] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0170.101] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0170.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0170.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424566524B415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424566524b415b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0170.103] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2978 [0170.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0170.103] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0170.191] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2978, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2978, lpOverlapped=0x0) returned 1 [0170.193] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2980, lpOverlapped=0x0) returned 1 [0170.194] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.216] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.227] CloseHandle (hObject=0x110) returned 1 [0170.227] CloseHandle (hObject=0x108) returned 1 [0170.227] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424566524B415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424566524b415b315d.jpg")) returned 0 [0170.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42424566524B415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42424566524b415b315d.jpg")) returned 0x2020 [0170.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 0x325098 [0170.228] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 0 [0170.229] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0170.229] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg")) returned 1 [0170.230] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg")) returned 0xffffffff [0170.230] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 1 [0170.230] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0170.230] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.230] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0170.230] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0170.231] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0170.231] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.231] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0170.231] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0170.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0170.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245665277765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245665277765b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0170.232] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b6c [0170.232] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0170.232] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0170.320] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2b6c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2b6c, lpOverlapped=0x0) returned 1 [0170.322] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2b70, lpOverlapped=0x0) returned 1 [0170.324] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.346] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.357] CloseHandle (hObject=0x108) returned 1 [0170.357] CloseHandle (hObject=0x110) returned 1 [0170.357] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245665277765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245665277765b315d.jpg")) returned 0 [0170.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245665277765B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245665277765b315d.jpg")) returned 0x2020 [0170.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 0x325098 [0170.358] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 0 [0170.359] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0170.359] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg")) returned 1 [0170.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg")) returned 0xffffffff [0170.360] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1 [0170.360] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0170.361] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.361] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0170.361] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0170.361] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.361] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac74) returned 0x10ab [0170.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0170.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245667774555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245667774555b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0170.362] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2676 [0170.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0170.362] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0170.461] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2676, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2676, lpOverlapped=0x0) returned 1 [0170.468] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2680, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2680, lpOverlapped=0x0) returned 1 [0170.469] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.491] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.504] CloseHandle (hObject=0x110) returned 1 [0170.505] CloseHandle (hObject=0x108) returned 1 [0170.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245667774555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245667774555b315d.jpg")) returned 0 [0170.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245667774555B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245667774555b315d.jpg")) returned 0x2020 [0170.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0x325098 [0170.506] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0 [0170.506] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0170.507] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg")) returned 1 [0170.508] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg")) returned 0xffffffff [0170.508] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 1 [0170.508] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0170.509] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.509] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0170.509] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0170.509] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0170.509] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.509] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afb4) returned 0x10ab [0170.509] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0170.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0170.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245665934585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245665934585b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0170.511] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb41 [0170.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0170.511] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0170.600] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb41, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xb41, lpOverlapped=0x0) returned 1 [0170.602] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xb50, lpOverlapped=0x0) returned 1 [0170.603] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.626] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.637] CloseHandle (hObject=0x108) returned 1 [0170.637] CloseHandle (hObject=0x110) returned 1 [0170.637] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245665934585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245665934585b315d.jpg")) returned 0 [0170.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245665934585B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245665934585b315d.jpg")) returned 0x2020 [0170.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 0x325098 [0170.638] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 0 [0170.638] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0170.638] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg")) returned 1 [0170.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg")) returned 0xffffffff [0170.639] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 1 [0170.639] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0170.639] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.639] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0170.639] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0170.640] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0170.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0170.640] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0170.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0170.641] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245674439665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245674439665b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0170.641] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25f6 [0170.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0170.642] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0170.741] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x25f6, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x25f6, lpOverlapped=0x0) returned 1 [0170.742] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2600, lpOverlapped=0x0) returned 1 [0170.743] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.766] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.777] CloseHandle (hObject=0x110) returned 1 [0170.777] CloseHandle (hObject=0x108) returned 1 [0170.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245674439665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245674439665b315d.jpg")) returned 0 [0170.778] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245674439665B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245674439665b315d.jpg")) returned 0x2020 [0170.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 0x325098 [0170.778] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 0 [0170.778] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0170.778] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg")) returned 1 [0170.779] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg")) returned 0xffffffff [0170.779] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1 [0170.780] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0170.780] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.780] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0170.780] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0170.780] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0170.780] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.780] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0170.780] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0170.781] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0170.781] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245674A667A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245674a667a5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0170.782] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x819 [0170.782] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0170.782] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0170.855] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x819, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x819, lpOverlapped=0x0) returned 1 [0170.861] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x820, lpOverlapped=0x0) returned 1 [0170.863] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.885] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.897] CloseHandle (hObject=0x108) returned 1 [0170.897] CloseHandle (hObject=0x110) returned 1 [0170.897] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245674A667A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245674a667a5b315d.jpg")) returned 0 [0170.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245674A667A5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245674a667a5b315d.jpg")) returned 0x2020 [0170.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0x325098 [0170.898] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0 [0170.898] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0170.898] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg")) returned 1 [0170.899] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg")) returned 0xffffffff [0170.899] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 1 [0170.900] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0170.900] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.900] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0170.900] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0170.900] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0170.900] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0170.901] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0170.901] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0170.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0170.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245677357415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245677357415b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0170.902] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x916 [0170.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0170.903] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0170.991] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x916, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x916, lpOverlapped=0x0) returned 1 [0170.993] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x920, lpOverlapped=0x0) returned 1 [0170.994] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.017] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.028] CloseHandle (hObject=0x110) returned 1 [0171.028] CloseHandle (hObject=0x108) returned 1 [0171.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245677357415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245677357415b315d.jpg")) returned 0 [0171.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245677357415B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245677357415b315d.jpg")) returned 0x2020 [0171.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 0x325098 [0171.029] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 0 [0171.029] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0171.029] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg")) returned 1 [0171.030] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg")) returned 0xffffffff [0171.030] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1 [0171.030] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0171.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0171.031] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abcc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0171.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abcc) returned 0x10ab [0171.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0171.032] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245675835475B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245675835475b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0171.032] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x918 [0171.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0171.033] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0171.123] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x918, lpOverlapped=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x920, lpOverlapped=0x0) returned 1 [0171.126] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.149] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.160] CloseHandle (hObject=0x108) returned 1 [0171.160] CloseHandle (hObject=0x110) returned 1 [0171.160] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245675835475B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245675835475b315d.jpg")) returned 0 [0171.161] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\424245675835475B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\424245675835475b315d.jpg")) returned 0x2020 [0171.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0x325098 [0171.161] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0 [0171.161] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0171.161] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg")) returned 1 [0171.162] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg")) returned 0xffffffff [0171.162] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 1 [0171.163] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0171.163] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.163] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0171.163] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0171.163] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0171.163] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.163] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0171.163] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0171.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0171.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242696835485B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242696835485b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0171.165] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2 [0171.165] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0171.165] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0171.255] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3a2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3a2, lpOverlapped=0x0) returned 1 [0171.257] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3b0, lpOverlapped=0x0) returned 1 [0171.258] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.280] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.291] CloseHandle (hObject=0x110) returned 1 [0171.291] CloseHandle (hObject=0x108) returned 1 [0171.291] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242696835485B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242696835485b315d.png")) returned 0 [0171.292] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\4242696835485B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\4242696835485b315d.png")) returned 0x2020 [0171.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 0x325098 [0171.292] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 0 [0171.292] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0171.292] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png")) returned 1 [0171.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png")) returned 0xffffffff [0171.293] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 1 [0171.294] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0171.294] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0171.294] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0171.294] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0171.294] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0171.294] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0171.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0171.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426D5578524B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426d5578524b5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0171.296] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24c [0171.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0171.296] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0171.380] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x24c, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x24c, lpOverlapped=0x0) returned 1 [0171.384] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x250, lpOverlapped=0x0) returned 1 [0171.386] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.442] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.454] CloseHandle (hObject=0x108) returned 1 [0171.454] CloseHandle (hObject=0x110) returned 1 [0171.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426D5578524B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426d5578524b5b315d.png")) returned 0 [0171.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426D5578524B5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426d5578524b5b315d.png")) returned 0x2020 [0171.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 0x325098 [0171.456] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 0 [0171.456] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0171.456] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png")) returned 1 [0171.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png")) returned 0xffffffff [0171.458] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 1 [0171.458] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0171.458] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.459] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0171.459] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0171.459] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b024, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0171.459] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.459] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b024) returned 0x10ab [0171.459] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0171.459] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0171.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426E64684A415B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426e64684a415b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0171.461] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x398 [0171.461] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0171.461] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0171.537] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x398, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x398, lpOverlapped=0x0) returned 1 [0171.538] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3a0, lpOverlapped=0x0) returned 1 [0171.539] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.562] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.572] CloseHandle (hObject=0x110) returned 1 [0171.572] CloseHandle (hObject=0x108) returned 1 [0171.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426E64684A415B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426e64684a415b315d.png")) returned 0 [0171.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426E64684A415B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426e64684a415b315d.png")) returned 0x2020 [0171.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 0x325098 [0171.573] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 0 [0171.573] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0171.574] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png")) returned 1 [0171.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png")) returned 0xffffffff [0171.575] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 1 [0171.575] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0171.575] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.575] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0171.575] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0171.576] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b024, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0171.576] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.576] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b024) returned 0x10ab [0171.576] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0171.576] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0171.576] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426F7146304A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426f7146304a5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0171.611] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x230 [0171.611] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0171.611] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0171.711] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x230, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x230, lpOverlapped=0x0) returned 1 [0171.712] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x240, lpOverlapped=0x0) returned 1 [0171.713] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.736] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.747] CloseHandle (hObject=0x108) returned 1 [0171.747] CloseHandle (hObject=0x110) returned 1 [0171.747] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426F7146304A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426f7146304a5b315d.png")) returned 0 [0171.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42426F7146304A5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42426f7146304a5b315d.png")) returned 0x2020 [0171.748] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 0x325098 [0171.748] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 0 [0171.748] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0171.749] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png")) returned 1 [0171.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png")) returned 0xffffffff [0171.750] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 1 [0171.750] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0171.750] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.750] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0171.750] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aca4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0171.750] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.750] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aca4) returned 0x10ab [0171.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0171.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42427A6A5639455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42427a6a5639455b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0171.755] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0171.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0171.755] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0171.849] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x116, lpOverlapped=0x0) returned 1 [0171.851] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x120, lpOverlapped=0x0) returned 1 [0171.852] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.875] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.886] CloseHandle (hObject=0x110) returned 1 [0171.886] CloseHandle (hObject=0x108) returned 1 [0171.886] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42427A6A5639455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42427a6a5639455b315d.png")) returned 0 [0171.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\42427A6A5639455B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\42427a6a5639455b315d.png")) returned 0x2020 [0171.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 0x325098 [0171.887] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 0 [0171.888] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0171.888] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png")) returned 1 [0171.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png")) returned 0xffffffff [0171.889] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1 [0171.889] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0171.889] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.890] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0171.890] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0171.890] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aff0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0171.890] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0171.890] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aff0) returned 0x10ab [0171.890] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0171.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0171.891] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\62656E65666974732D315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\62656e65666974732d315b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0171.891] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fdaf [0171.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0171.891] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0171.985] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1fdaf, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1fdaf, lpOverlapped=0x0) returned 1 [0171.989] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1fdb0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1fdb0, lpOverlapped=0x0) returned 1 [0171.992] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.017] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.028] CloseHandle (hObject=0x108) returned 1 [0172.028] CloseHandle (hObject=0x110) returned 1 [0172.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\62656E65666974732D315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\62656e65666974732d315b315d.jpg")) returned 0 [0172.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\62656E65666974732D315B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\62656e65666974732d315b315d.jpg")) returned 0x2020 [0172.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0x325098 [0172.029] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0 [0172.029] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0172.029] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg")) returned 1 [0172.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg")) returned 0xffffffff [0172.031] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0172.031] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.032] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0172.032] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0172.032] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b070, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0172.032] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.032] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b070) returned 0x10ab [0172.032] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0172.032] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 1 [0172.032] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.032] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0172.033] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0172.033] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b070, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0172.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b070) returned 0x10ab [0172.033] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0172.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0172.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368617274626561745B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368617274626561745b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0172.034] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82d8 [0172.034] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0172.034] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0172.108] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x82d8, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x82d8, lpOverlapped=0x0) returned 1 [0172.110] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x82e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x82e0, lpOverlapped=0x0) returned 1 [0172.112] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.134] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.145] CloseHandle (hObject=0x110) returned 1 [0172.145] CloseHandle (hObject=0x108) returned 1 [0172.145] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368617274626561745B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368617274626561745b315d.js")) returned 0 [0172.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368617274626561745B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368617274626561745b315d.js")) returned 0x2020 [0172.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 0x325098 [0172.147] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 0 [0172.147] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0172.147] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js")) returned 1 [0172.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js")) returned 0xffffffff [0172.148] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 1 [0172.148] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.148] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0172.149] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0172.149] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b070, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0172.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b070) returned 0x10ab [0172.149] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0172.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0172.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368726F6D652D696E7374616C6C65722E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368726f6d652d696e7374616c6c65722e6d696e5b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0172.150] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bf20 [0172.150] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0172.150] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0172.239] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3bf20, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3bf20, lpOverlapped=0x0) returned 1 [0172.245] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3bf30, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3bf30, lpOverlapped=0x0) returned 1 [0172.250] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.273] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.284] CloseHandle (hObject=0x108) returned 1 [0172.284] CloseHandle (hObject=0x110) returned 1 [0172.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368726F6D652D696E7374616C6C65722E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368726f6d652d696e7374616c6c65722e6d696e5b315d.js")) returned 0 [0172.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368726F6D652D696E7374616C6C65722E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368726f6d652d696e7374616c6c65722e6d696e5b315d.js")) returned 0x2020 [0172.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 0x325098 [0172.285] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 0 [0172.285] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0172.285] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js")) returned 1 [0172.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js")) returned 0xffffffff [0172.287] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0172.288] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0172.288] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0172.288] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b070, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0172.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b070) returned 0x10ab [0172.288] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0172.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0172.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368726F6D655F6C6F676F5F32785B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368726f6d655f6c6f676f5f32785b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0172.289] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1622 [0172.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0172.290] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0172.384] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1622, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1622, lpOverlapped=0x0) returned 1 [0172.386] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1630, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x1630, lpOverlapped=0x0) returned 1 [0172.387] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.421] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.431] CloseHandle (hObject=0x110) returned 1 [0172.431] CloseHandle (hObject=0x108) returned 1 [0172.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368726F6D655F6C6F676F5F32785B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368726f6d655f6c6f676f5f32785b315d.png")) returned 0 [0172.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6368726F6D655F6C6F676F5F32785B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6368726f6d655f6c6f676f5f32785b315d.png")) returned 0x2020 [0172.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 0x325098 [0172.433] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 0 [0172.433] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0172.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png")) returned 1 [0172.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png")) returned 0xffffffff [0172.434] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 1 [0172.435] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.435] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.435] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0172.435] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aea4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0172.435] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.435] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aea4) returned 0x10ab [0172.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0172.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\636C6F73652D69636F6E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\636c6f73652d69636f6e5b315d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0172.436] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d [0172.436] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0172.436] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0172.514] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13d, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x13d, lpOverlapped=0x0) returned 1 [0172.516] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x140, lpOverlapped=0x0) returned 1 [0172.517] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.539] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.550] CloseHandle (hObject=0x108) returned 1 [0172.550] CloseHandle (hObject=0x110) returned 1 [0172.550] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\636C6F73652D69636F6E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\636c6f73652d69636f6e5b315d.png")) returned 0 [0172.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\636C6F73652D69636F6E5B315D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\636c6f73652d69636f6e5b315d.png")) returned 0x2020 [0172.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 0x325098 [0172.551] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 0 [0172.551] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0172.551] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png")) returned 1 [0172.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png")) returned 0xffffffff [0172.552] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 1 [0172.553] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.553] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.553] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0172.553] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0172.553] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0172.553] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.553] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0172.553] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0172.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0172.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6373735B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6373735b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0172.555] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269b2 [0172.555] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0172.555] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0172.645] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x269b2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x269b2, lpOverlapped=0x0) returned 1 [0172.650] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x269c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x269c0, lpOverlapped=0x0) returned 1 [0172.653] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.676] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.687] CloseHandle (hObject=0x110) returned 1 [0172.687] CloseHandle (hObject=0x108) returned 1 [0172.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6373735B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6373735b315d.txt")) returned 0 [0172.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6373735B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6373735b315d.txt")) returned 0x2020 [0172.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 0x325098 [0172.688] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 0 [0172.688] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0172.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt")) returned 1 [0172.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt")) returned 0xffffffff [0172.690] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.690] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0172.690] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0172.691] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b100, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0172.691] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.691] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b100) returned 0x10ab [0172.691] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0172.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0172.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0172.692] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0172.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0172.692] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0172.792] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x43, lpOverlapped=0x0) returned 1 [0172.793] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x50, lpOverlapped=0x0) returned 1 [0172.794] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.817] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.829] CloseHandle (hObject=0x108) returned 1 [0172.829] CloseHandle (hObject=0x110) returned 1 [0172.830] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6465736b746f70.ini")) returned 0 [0172.830] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6465736b746f70.ini")) returned 0x2020 [0172.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325098 [0172.831] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.831] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0172.831] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini")) returned 1 [0172.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini")) returned 0xffffffff [0172.843] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 1 [0172.846] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.847] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.849] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0172.849] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0172.849] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b024, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0172.849] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0172.849] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b024) returned 0x10ab [0172.850] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0172.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0172.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\656248746D6C3542616E6E65725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\656248746d6c3542616e6e65725b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0172.854] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d5b9 [0172.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0172.855] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0172.930] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4d5b9, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x4d5b9, lpOverlapped=0x0) returned 1 [0172.939] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4d5c0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x4d5c0, lpOverlapped=0x0) returned 1 [0172.961] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.983] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.994] CloseHandle (hObject=0x110) returned 1 [0172.994] CloseHandle (hObject=0x108) returned 1 [0172.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\656248746D6C3542616E6E65725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\656248746d6c3542616e6e65725b315d.js")) returned 0 [0172.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\656248746D6C3542616E6E65725B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\656248746d6c3542616e6e65725b315d.js")) returned 0x2020 [0172.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 0x325098 [0172.996] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 0 [0172.996] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0172.996] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js")) returned 1 [0172.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js")) returned 0xffffffff [0172.999] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 1 [0172.999] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0172.999] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.000] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa28) returned 0x10ab [0173.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0173.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\65756C612D77696E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\65756c612d77696e5b315d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0173.001] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5244 [0173.001] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0173.001] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0173.082] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5244, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x5244, lpOverlapped=0x0) returned 1 [0173.084] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5250, lpOverlapped=0x0) returned 1 [0173.085] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.108] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.119] CloseHandle (hObject=0x108) returned 1 [0173.119] CloseHandle (hObject=0x110) returned 1 [0173.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\65756C612D77696E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\65756c612d77696e5b315d.jpg")) returned 0 [0173.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\65756C612D77696E5B315D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\65756c612d77696e5b315d.jpg")) returned 0x2020 [0173.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 0x325098 [0173.120] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 0 [0173.120] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0173.121] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg")) returned 1 [0173.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg")) returned 0xffffffff [0173.122] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1303, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~3")) returned 1 [0173.123] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.123] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b02c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b02c) returned 0x10ab [0173.124] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.124] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8c3, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0173.124] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.124] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.124] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.124] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aefc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.124] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.124] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aefc) returned 0x10ab [0173.124] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe138690, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe138690, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe138690, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0173.125] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.125] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.125] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b02c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b02c) returned 0x10ab [0173.125] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.125] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0173.125] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.126] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.126] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad1c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.126] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.126] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad1c) returned 0x10ab [0173.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0173.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6A71756572792D312E31312E312E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6a71756572792d312e31312e312e6d696e5b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0173.127] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1762e [0173.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0173.128] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0173.217] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1762e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x1762e, lpOverlapped=0x0) returned 1 [0173.221] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x17630, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x17630, lpOverlapped=0x0) returned 1 [0173.223] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.246] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.257] CloseHandle (hObject=0x110) returned 1 [0173.257] CloseHandle (hObject=0x108) returned 1 [0173.257] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6A71756572792D312E31312E312E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6a71756572792d312e31312e312e6d696e5b315d.js")) returned 0 [0173.258] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6A71756572792D312E31312E312E6D696E5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6a71756572792d312e31312e312e6d696e5b315d.js")) returned 0x2020 [0173.258] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 0x325098 [0173.258] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 0 [0173.258] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0173.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js")) returned 1 [0173.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js")) returned 0xffffffff [0173.260] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5442d110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5442d110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5442d110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0173.260] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.260] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.260] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.260] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.261] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.261] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.261] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0173.261] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.261] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0173.261] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.267] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.267] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.267] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.268] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.268] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.268] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0173.268] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.268] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0173.268] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.268] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.268] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.268] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.269] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.269] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.269] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0173.269] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.269] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 1 [0173.269] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.269] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.269] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.269] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.269] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.270] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.270] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0173.270] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.270] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 1 [0173.270] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.270] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.270] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.270] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.270] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.270] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.270] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0173.271] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.271] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 1 [0173.271] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.271] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.271] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0173.271] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0173.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6D736E5B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6d736e5b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0173.273] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x922 [0173.273] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0173.273] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0173.363] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x922, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x922, lpOverlapped=0x0) returned 1 [0173.364] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x930, lpOverlapped=0x0) returned 1 [0173.365] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.397] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.407] CloseHandle (hObject=0x108) returned 1 [0173.407] CloseHandle (hObject=0x110) returned 1 [0173.408] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6D736E5B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6d736e5b315d.htm")) returned 0 [0173.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\6D736E5B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\6d736e5b315d.htm")) returned 0x2020 [0173.409] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 0x325098 [0173.409] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 0 [0173.409] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0173.409] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm")) returned 1 [0173.410] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm")) returned 0xffffffff [0173.410] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 1 [0173.410] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.410] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.410] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.410] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.411] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aff8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.411] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.411] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aff8) returned 0x10ab [0173.411] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0173.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\7270635F7368696E6469675F72616E646F6D5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\7270635f7368696e6469675f72616e646f6d5b315d.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0173.412] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3112 [0173.412] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0173.412] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0173.490] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3112, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x3112, lpOverlapped=0x0) returned 1 [0173.492] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3120, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x3120, lpOverlapped=0x0) returned 1 [0173.493] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.516] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.527] CloseHandle (hObject=0x110) returned 1 [0173.527] CloseHandle (hObject=0x108) returned 1 [0173.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\7270635F7368696E6469675F72616E646F6D5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\7270635f7368696e6469675f72616e646f6d5b315d.js")) returned 0 [0173.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\7270635F7368696E6469675F72616E646F6D5B315D.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\7270635f7368696e6469675f72616e646f6d5b315d.js")) returned 0x2020 [0173.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 0x325098 [0173.528] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 0 [0173.528] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0173.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js")) returned 1 [0173.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js")) returned 0xffffffff [0173.529] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xbf7d5790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="thirdparty[1]", cAlternateFileName="THIRDP~1")) returned 1 [0173.530] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.530] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.530] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b078, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b078) returned 0x10ab [0173.530] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.530] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 1 [0173.531] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.531] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.531] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.531] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.531] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b078, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.531] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.531] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b078) returned 0x10ab [0173.531] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0173.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\7569645B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\7569645b315d.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0173.533] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa33 [0173.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0173.533] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0173.628] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa33, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0xa33, lpOverlapped=0x0) returned 1 [0173.660] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0xa40, lpOverlapped=0x0) returned 1 [0173.661] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.689] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.700] CloseHandle (hObject=0x108) returned 1 [0173.700] CloseHandle (hObject=0x110) returned 1 [0173.701] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\7569645B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\7569645b315d.htm")) returned 0 [0173.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\7569645B315D.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\7569645b315d.htm")) returned 0x2020 [0173.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 0x325098 [0173.702] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 0 [0173.702] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0173.702] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm")) returned 1 [0173.703] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm")) returned 0xffffffff [0173.703] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe5d5130, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe5d5130, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3325, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0173.703] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.704] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.704] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b078, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b078) returned 0x10ab [0173.704] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.704] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 1 [0173.705] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.705] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.705] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.705] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b078, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.705] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b078) returned 0x10ab [0173.705] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0173.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\77632D6164646F6E735B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\77632d6164646f6e735b315d.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0173.715] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24fea [0173.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0173.716] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0173.804] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x24fea, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x24fea, lpOverlapped=0x0) returned 1 [0173.809] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x24ff0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x24ff0, lpOverlapped=0x0) returned 1 [0173.812] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.835] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.846] CloseHandle (hObject=0x110) returned 1 [0173.846] CloseHandle (hObject=0x108) returned 1 [0173.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\77632D6164646F6E735B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\77632d6164646f6e735b315d.css")) returned 0 [0173.847] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\77632D6164646F6E735B315D.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\77632d6164646f6e735b315d.css")) returned 0x2020 [0173.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0x325098 [0173.847] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0 [0173.847] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0173.847] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css")) returned 1 [0173.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css")) returned 0xffffffff [0173.849] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0 [0173.849] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0173.849] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0 [0173.849] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0173.850] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x342d3841, dwReserved1=0x2d414133, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0173.850] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.850] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.850] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.850] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad20, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.850] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.850] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad20) returned 0x10ab [0173.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0173.851] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0173.853] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0173.853] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0173.854] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0173.947] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x43, lpOverlapped=0x0) returned 1 [0173.949] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x50, lpOverlapped=0x0) returned 1 [0173.949] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.972] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.983] CloseHandle (hObject=0x100) returned 1 [0173.983] CloseHandle (hObject=0x10c) returned 1 [0173.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\6465736b746f70.ini")) returned 0 [0173.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\6465736b746f70.ini")) returned 0x2020 [0173.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0173.984] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0173.985] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0173.985] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini")) returned 1 [0173.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini")) returned 0xffffffff [0173.985] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0173.986] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.986] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0173.986] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afdc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afdc) returned 0x10ab [0173.987] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0173.987] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0173.987] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0173.987] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77353854, dwReserved1=0x7758b0bb, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0173.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0173.988] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="..", cAlternateFileName="")) returned 1 [0173.988] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="C", cAlternateFileName="")) returned 1 [0173.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName=".", cAlternateFileName="")) returned 0x325018 [0173.988] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="..", cAlternateFileName="")) returned 1 [0173.988] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="Users", cAlternateFileName="")) returned 1 [0173.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0173.989] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.989] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0173.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325098 [0173.989] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.989] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0173.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0173.990] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.990] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0173.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x325118 [0173.990] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 1 [0173.991] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0173.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18dd18 | out: lpFindFileData=0x18dd18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x337fe8, dwReserved1=0x300000, cFileName=".", cAlternateFileName="")) returned 0x325158 [0173.992] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dd18 | out: lpFindFileData=0x18dd18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x337fe8, dwReserved1=0x300000, cFileName="..", cAlternateFileName="")) returned 1 [0173.992] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dd18 | out: lpFindFileData=0x18dd18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x337fe8, dwReserved1=0x300000, cFileName="Windows", cAlternateFileName="")) returned 1 [0173.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18dab0 | out: lpFindFileData=0x18dab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x325198 [0173.992] FindNextFileA (in: hFindFile=0x325198, lpFindFileData=0x18dab0 | out: lpFindFileData=0x18dab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 1 [0173.992] FindNextFileA (in: hFindFile=0x325198, lpFindFileData=0x18dab0 | out: lpFindFileData=0x18dab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0173.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18d848 | out: lpFindFileData=0x18d848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x339fe8, dwReserved1=0x300000, cFileName=".", cAlternateFileName="")) returned 0x3251d8 [0173.992] FindNextFileA (in: hFindFile=0x3251d8, lpFindFileData=0x18d848 | out: lpFindFileData=0x18d848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x339fe8, dwReserved1=0x300000, cFileName="..", cAlternateFileName="")) returned 1 [0173.993] FindNextFileA (in: hFindFile=0x3251d8, lpFindFileData=0x18d848 | out: lpFindFileData=0x18d848*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x339fe8, dwReserved1=0x300000, cFileName="Low", cAlternateFileName="")) returned 1 [0173.993] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18d5e0 | out: lpFindFileData=0x18d5e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x325218 [0173.993] FindNextFileA (in: hFindFile=0x325218, lpFindFileData=0x18d5e0 | out: lpFindFileData=0x18d5e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 1 [0173.993] FindNextFileA (in: hFindFile=0x325218, lpFindFileData=0x18d5e0 | out: lpFindFileData=0x18d5e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 0 [0173.993] FindClose (in: hFindFile=0x325218 | out: hFindFile=0x325218) returned 1 [0173.993] FindNextFileA (in: hFindFile=0x3251d8, lpFindFileData=0x18d848 | out: lpFindFileData=0x18d848*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x339fe8, dwReserved1=0x300000, cFileName="Low", cAlternateFileName="")) returned 0 [0173.993] FindClose (in: hFindFile=0x3251d8 | out: hFindFile=0x3251d8) returned 1 [0173.993] FindNextFileA (in: hFindFile=0x325198, lpFindFileData=0x18dab0 | out: lpFindFileData=0x18dab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="PrivacIE", cAlternateFileName="")) returned 0 [0173.993] FindClose (in: hFindFile=0x325198 | out: hFindFile=0x325198) returned 1 [0173.993] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18dd18 | out: lpFindFileData=0x18dd18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x337fe8, dwReserved1=0x300000, cFileName="Windows", cAlternateFileName="")) returned 0 [0173.993] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0173.993] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0173.993] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0173.994] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0173.994] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0173.994] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0173.994] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0173.994] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0173.994] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0173.994] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="Users", cAlternateFileName="")) returned 0 [0173.994] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0173.994] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="C", cAlternateFileName="")) returned 0 [0173.994] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0173.994] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77353854, dwReserved1=0x7758b0bb, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0173.994] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0173.994] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7264, dwReserved1=0x5f626262, cFileName="Themes", cAlternateFileName="")) returned 1 [0173.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77353854, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0173.995] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77353854, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0173.996] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x77353854, dwReserved1=0x7758b0bb, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0173.997] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.997] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29960, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29960) returned 0x10ab [0173.997] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x77353854, dwReserved1=0x7758b0bb, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0 [0173.997] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0173.997] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0173.997] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.998] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.998] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.998] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c299e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.998] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.998] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c299e4) returned 0x10ab [0173.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.998] CloseHandle (hObject=0xffffffff) returned 0 [0173.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\557372436C617373.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\557372436c617373.dat")) returned 0 [0173.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\557372436C617373.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\557372436c617373.dat")) returned 0xffffffff [0173.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 0x324f98 [0173.998] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 0 [0173.998] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0173.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0 [0173.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0x22 [0173.999] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0173.999] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.999] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.999] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.999] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adcc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.999] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.999] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adcc) returned 0x10ab [0173.999] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0173.999] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0173.999] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.999] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0173.999] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29db8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0173.999] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0173.999] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29db8) returned 0x10ab [0174.000] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0174.000] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.000] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29edc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29edc) returned 0x10ab [0174.000] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0174.000] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.000] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a0a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a0a8) returned 0x10ab [0174.000] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0174.001] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.001] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.001] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.001] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a274, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.001] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.001] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a274) returned 0x10ab [0174.001] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="WER", cAlternateFileName="")) returned 1 [0174.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0174.001] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0174.002] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="ERC", cAlternateFileName="")) returned 1 [0174.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0174.002] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0174.002] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 0 [0174.002] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0174.002] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0174.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0174.002] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0174.002] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 0 [0174.002] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0174.002] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0174.002] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0174.002] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186576, dwReserved1=0x18ed24, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0174.003] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.003] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.003] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.003] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ee0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.003] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.003] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ee0) returned 0x10ab [0174.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0174.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\57696E646F7773557064617465.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\57696e646f7773557064617465.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0174.005] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0174.005] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0174.005] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0174.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\57696E646F7773557064617465.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\57696e646f7773557064617465.log")) returned 0 [0174.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\57696E646F7773557064617465.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\57696e646f7773557064617465.log")) returned 0x2020 [0174.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0x324f98 [0174.139] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0174.139] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0174.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log")) returned 1 [0174.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log")) returned 0xffffffff [0174.140] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186576, dwReserved1=0x18ed24, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0174.140] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0174.140] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c2e6574, dwReserved1=0x6137676f, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0174.140] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0174.142] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0174.142] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0174.143] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.143] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.143] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.143] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28360, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.143] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.143] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28360) returned 0x10ab [0174.143] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0174.143] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.143] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.143] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.144] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c284b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.144] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.144] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c284b0) returned 0x10ab [0174.144] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0174.144] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.144] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.144] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.144] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28600, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.144] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.144] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28600) returned 0x10ab [0174.144] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Backup", cAlternateFileName="")) returned 1 [0174.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0174.144] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0174.145] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="old", cAlternateFileName="")) returned 1 [0174.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0174.146] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.146] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0174.146] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.146] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.146] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.146] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2879c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.146] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.146] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2879c) returned 0x10ab [0174.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0174.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\6564623030303031.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\6564623030303031.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0174.148] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0174.148] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0174.148] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0174.238] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x200000, lpOverlapped=0x0) returned 1 [0174.294] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x200010, lpOverlapped=0x0) returned 1 [0174.335] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.358] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.368] CloseHandle (hObject=0x10c) returned 1 [0174.369] CloseHandle (hObject=0x100) returned 1 [0174.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\6564623030303031.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\6564623030303031.log")) returned 0 [0174.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\6564623030303031.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\6564623030303031.log")) returned 0x2020 [0174.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="edb00001.log", cAlternateFileName="")) returned 0x325018 [0174.370] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="edb00001.log", cAlternateFileName="")) returned 0 [0174.370] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0174.370] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log")) returned 1 [0174.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log")) returned 0xffffffff [0174.378] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0174.379] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.379] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.379] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.379] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29c44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.379] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.379] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29c44) returned 0x10ab [0174.379] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0174.379] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.379] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.380] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.380] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29c44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.380] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.380] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29c44) returned 0x10ab [0174.380] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0174.380] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0174.380] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="old", cAlternateFileName="")) returned 0 [0174.380] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0174.380] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0174.380] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.380] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.380] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.380] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28aa4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.380] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.380] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28aa4) returned 0x10ab [0174.380] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0174.381] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\656462.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\656462.chk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0174.381] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0174.381] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0174.382] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0174.472] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x2000, lpOverlapped=0x0) returned 1 [0174.474] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x2010, lpOverlapped=0x0) returned 1 [0174.475] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.497] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.508] CloseHandle (hObject=0xfc) returned 1 [0174.508] CloseHandle (hObject=0x104) returned 1 [0174.508] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\656462.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\656462.chk")) returned 0 [0174.508] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\656462.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\656462.chk")) returned 0x2020 [0174.508] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="edb.chk", cAlternateFileName="")) returned 0x324f98 [0174.509] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="edb.chk", cAlternateFileName="")) returned 0 [0174.509] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0174.509] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 1 [0174.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 0xffffffff [0174.510] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="edb.log", cAlternateFileName="")) returned 1 [0174.510] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.510] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.511] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.511] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29e24, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.511] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.511] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29e24) returned 0x10ab [0174.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0174.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\656462.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\656462.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0174.512] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0174.512] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0174.512] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0174.605] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0174.807] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0174.847] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.870] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.881] CloseHandle (hObject=0x104) returned 1 [0174.881] CloseHandle (hObject=0xfc) returned 1 [0174.881] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\656462.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\656462.log")) returned 0 [0174.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\656462.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\656462.log")) returned 0x2020 [0174.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="edb.log", cAlternateFileName="")) returned 0x324f98 [0174.882] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="edb.log", cAlternateFileName="")) returned 0 [0174.882] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0174.882] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log")) returned 1 [0174.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log")) returned 0xffffffff [0174.891] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0174.891] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0174.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0174.891] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c288c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0174.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0174.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c288c4) returned 0x10ab [0174.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0174.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\6564623030303031.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\6564623030303031.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0174.892] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0174.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0174.893] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0174.932] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0174.996] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0175.050] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.072] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.083] CloseHandle (hObject=0xfc) returned 1 [0175.083] CloseHandle (hObject=0x104) returned 1 [0175.083] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\6564623030303031.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\6564623030303031.log")) returned 0 [0175.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\6564623030303031.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\6564623030303031.log")) returned 0x2020 [0175.084] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="edb00001.log", cAlternateFileName="")) returned 0x324f98 [0175.084] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="edb00001.log", cAlternateFileName="")) returned 0 [0175.084] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0175.084] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log")) returned 1 [0175.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log")) returned 0xffffffff [0175.093] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0175.093] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.093] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.093] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.093] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a130, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.093] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.093] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a130) returned 0x10ab [0175.094] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0175.094] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.094] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a1ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a1ec) returned 0x10ab [0175.094] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0175.094] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.094] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a29c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a29c) returned 0x10ab [0175.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\6F656F6C64.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\6f656f6c64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0175.104] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0175.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.105] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0175.137] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x104, lpOverlapped=0x0) returned 1 [0175.138] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x110, lpOverlapped=0x0) returned 1 [0175.139] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.161] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.173] CloseHandle (hObject=0x104) returned 1 [0175.173] CloseHandle (hObject=0xfc) returned 1 [0175.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\6F656F6C64.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\6f656f6c64.xml")) returned 0 [0175.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\6F656F6C64.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\6f656f6c64.xml")) returned 0x2020 [0175.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="oeold.xml", cAlternateFileName="")) returned 0x324f98 [0175.174] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="oeold.xml", cAlternateFileName="")) returned 0 [0175.174] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0175.174] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml")) returned 1 [0175.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml")) returned 0xffffffff [0175.175] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0175.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9a0098, dwReserved1=0x31c838, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0175.177] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9a0098, dwReserved1=0x31c838, cFileName="..", cAlternateFileName="")) returned 1 [0175.177] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x9a0098, dwReserved1=0x31c838, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0175.177] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.178] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.178] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.178] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a288, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.178] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.178] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a288) returned 0x10ab [0175.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4265617273.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4265617273.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0175.179] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0175.179] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.179] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0175.212] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xff, lpOverlapped=0x0) returned 1 [0175.213] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x100, lpOverlapped=0x0) returned 1 [0175.214] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.237] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.248] CloseHandle (hObject=0x104) returned 1 [0175.248] CloseHandle (hObject=0x100) returned 1 [0175.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4265617273.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4265617273.htm")) returned 0 [0175.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4265617273.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4265617273.htm")) returned 0x2020 [0175.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Bears.htm", cAlternateFileName="")) returned 0x324fd8 [0175.249] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Bears.htm", cAlternateFileName="")) returned 0 [0175.249] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0175.249] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm")) returned 1 [0175.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm")) returned 0xffffffff [0175.250] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0175.250] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.250] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.250] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.251] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.251] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.251] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f50) returned 0x10ab [0175.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0175.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4265617273.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4265617273.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.252] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x432 [0175.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.253] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0175.285] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x432, lpOverlapped=0x0) returned 1 [0175.287] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x440, lpOverlapped=0x0) returned 1 [0175.288] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.311] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.322] CloseHandle (hObject=0x100) returned 1 [0175.322] CloseHandle (hObject=0x104) returned 1 [0175.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4265617273.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4265617273.jpg")) returned 0 [0175.324] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4265617273.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4265617273.jpg")) returned 0x2020 [0175.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Bears.jpg", cAlternateFileName="")) returned 0x324fd8 [0175.324] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Bears.jpg", cAlternateFileName="")) returned 0 [0175.324] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0175.324] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 1 [0175.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 0xffffffff [0175.325] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0175.325] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.325] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.326] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29fe0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.326] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29fe0) returned 0x10ab [0175.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0175.327] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x285 [0175.327] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.327] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0175.360] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x285, lpOverlapped=0x0) returned 1 [0175.361] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x290, lpOverlapped=0x0) returned 1 [0175.362] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.408] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.419] CloseHandle (hObject=0x104) returned 1 [0175.419] CloseHandle (hObject=0x100) returned 1 [0175.419] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4465736b746f70.ini")) returned 0 [0175.420] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4465736b746f70.ini")) returned 0x2020 [0175.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0175.420] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0175.420] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0175.420] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 1 [0175.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 0xffffffff [0175.421] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0175.421] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.422] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.422] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.422] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28a84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.422] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.422] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28a84) returned 0x10ab [0175.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0175.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\47617264656E.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\47617264656e.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.423] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7 [0175.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.423] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0175.487] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe7, lpOverlapped=0x0) returned 1 [0175.488] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0175.489] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.513] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.524] CloseHandle (hObject=0x100) returned 1 [0175.524] CloseHandle (hObject=0x104) returned 1 [0175.524] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\47617264656E.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\47617264656e.htm")) returned 0 [0175.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\47617264656E.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\47617264656e.htm")) returned 0x2020 [0175.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Garden.htm", cAlternateFileName="")) returned 0x324fd8 [0175.525] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Garden.htm", cAlternateFileName="")) returned 0 [0175.525] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0175.525] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm")) returned 1 [0175.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm")) returned 0xffffffff [0175.526] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0175.527] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.527] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a3c8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a3c8) returned 0x10ab [0175.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\47617264656E.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\47617264656e.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0175.529] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d3f [0175.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.529] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0175.636] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5d3f, lpOverlapped=0x0) returned 1 [0175.647] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5d40, lpOverlapped=0x0) returned 1 [0175.648] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.674] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.686] CloseHandle (hObject=0x104) returned 1 [0175.686] CloseHandle (hObject=0x100) returned 1 [0175.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\47617264656E.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\47617264656e.jpg")) returned 0 [0175.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\47617264656E.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\47617264656e.jpg")) returned 0x2020 [0175.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Garden.jpg", cAlternateFileName="")) returned 0x324fd8 [0175.687] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Garden.jpg", cAlternateFileName="")) returned 0 [0175.687] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0175.687] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 1 [0175.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 0xffffffff [0175.688] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0175.689] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.689] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a4ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a4ec) returned 0x10ab [0175.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0175.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\477265656E20427562626C6573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\477265656e20427562626c6573.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.690] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0175.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.690] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0175.793] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0175.794] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0175.794] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.817] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.828] CloseHandle (hObject=0x100) returned 1 [0175.828] CloseHandle (hObject=0x104) returned 1 [0175.828] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\477265656E20427562626C6573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\477265656e20427562626c6573.htm")) returned 0 [0175.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\477265656E20427562626C6573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\477265656e20427562626c6573.htm")) returned 0x2020 [0175.829] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 0x324fd8 [0175.829] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 0 [0175.829] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0175.829] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm")) returned 1 [0175.830] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm")) returned 0xffffffff [0175.830] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0175.831] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.831] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.831] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.831] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28a84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.831] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.831] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28a84) returned 0x10ab [0175.831] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.831] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\477265656E427562626C6573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\477265656e427562626c6573.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0175.832] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1906 [0175.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.832] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0175.905] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1906, lpOverlapped=0x0) returned 1 [0175.907] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1910, lpOverlapped=0x0) returned 1 [0175.908] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.932] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.943] CloseHandle (hObject=0x104) returned 1 [0175.943] CloseHandle (hObject=0x100) returned 1 [0175.943] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\477265656E427562626C6573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\477265656e427562626c6573.jpg")) returned 0 [0175.944] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\477265656E427562626C6573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\477265656e427562626c6573.jpg")) returned 0x2020 [0175.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0x324fd8 [0175.944] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0 [0175.944] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0175.944] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 1 [0175.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 0xffffffff [0175.945] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0175.945] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0175.945] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.945] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0175.945] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0175.945] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0175.946] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9cc) returned 0x10ab [0175.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0175.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\48616E64205072696E7473.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\48616e64205072696e7473.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0175.946] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0175.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0175.948] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0176.038] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xeb, lpOverlapped=0x0) returned 1 [0176.039] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0176.040] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.064] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.076] CloseHandle (hObject=0x100) returned 1 [0176.076] CloseHandle (hObject=0x104) returned 1 [0176.076] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\48616E64205072696E7473.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\48616e64205072696e7473.htm")) returned 0 [0176.077] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\48616E64205072696E7473.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\48616e64205072696e7473.htm")) returned 0x2020 [0176.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 0x324fd8 [0176.077] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 0 [0176.077] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0176.077] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm")) returned 1 [0176.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm")) returned 0xffffffff [0176.078] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0176.079] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0176.079] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.079] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0176.079] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab38, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0176.079] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.079] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab38) returned 0x10ab [0176.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0176.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\48616E645072696E7473.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\48616e645072696e7473.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0176.080] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107e [0176.080] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0176.080] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0176.169] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x107e, lpOverlapped=0x0) returned 1 [0176.171] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1080, lpOverlapped=0x0) returned 1 [0176.172] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.195] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.206] CloseHandle (hObject=0x104) returned 1 [0176.206] CloseHandle (hObject=0x100) returned 1 [0176.206] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\48616E645072696E7473.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\48616e645072696e7473.jpg")) returned 0 [0176.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\48616E645072696E7473.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\48616e645072696e7473.jpg")) returned 0x2020 [0176.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0x324fd8 [0176.207] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0 [0176.207] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0176.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 1 [0176.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 0xffffffff [0176.209] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0176.209] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0176.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0176.209] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28a18, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0176.209] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.209] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28a18) returned 0x10ab [0176.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0176.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4F72616E676520436972636C6573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4f72616e676520436972636c6573.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0176.211] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0176.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0176.212] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0176.300] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0176.301] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0176.302] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.325] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.336] CloseHandle (hObject=0x100) returned 1 [0176.336] CloseHandle (hObject=0x104) returned 1 [0176.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4F72616E676520436972636C6573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4f72616e676520436972636c6573.htm")) returned 0 [0176.337] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4F72616E676520436972636C6573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4f72616e676520436972636c6573.htm")) returned 0x2020 [0176.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 0x324fd8 [0176.337] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 0 [0176.337] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0176.337] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm")) returned 1 [0176.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm")) returned 0xffffffff [0176.338] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0176.338] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0176.338] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.338] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0176.339] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adfc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0176.339] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.339] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adfc) returned 0x10ab [0176.339] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0176.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4F72616E6765436972636C6573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4f72616e6765436972636c6573.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0176.340] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ed [0176.340] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0176.340] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0176.420] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18ed, lpOverlapped=0x0) returned 1 [0176.423] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x18f0, lpOverlapped=0x0) returned 1 [0176.424] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.446] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.457] CloseHandle (hObject=0x104) returned 1 [0176.457] CloseHandle (hObject=0x100) returned 1 [0176.461] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4F72616E6765436972636C6573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4f72616e6765436972636c6573.jpg")) returned 0 [0176.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\4F72616E6765436972636C6573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\4f72616e6765436972636c6573.jpg")) returned 0x2020 [0176.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0x324fd8 [0176.462] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0 [0176.462] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0176.462] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 1 [0176.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 0xffffffff [0176.463] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0176.463] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0176.463] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.463] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0176.464] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aebc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0176.464] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.464] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aebc) returned 0x10ab [0176.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0176.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\506561636F636B.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\506561636f636b.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0176.465] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0176.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0176.465] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0176.570] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe8, lpOverlapped=0x0) returned 1 [0176.572] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0176.574] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.601] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.612] CloseHandle (hObject=0x100) returned 1 [0176.612] CloseHandle (hObject=0x104) returned 1 [0176.613] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\506561636F636B.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\506561636f636b.htm")) returned 0 [0176.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\506561636F636B.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\506561636f636b.htm")) returned 0x2020 [0176.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Peacock.htm", cAlternateFileName="")) returned 0x324fd8 [0176.614] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Peacock.htm", cAlternateFileName="")) returned 0 [0176.614] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0176.615] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm")) returned 1 [0176.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm")) returned 0xffffffff [0176.616] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0176.616] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0176.616] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.617] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0176.617] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d14, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0176.617] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.617] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d14) returned 0x10ab [0176.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0176.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\506561636F636B.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\506561636f636b.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0176.619] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fb [0176.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0176.619] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0176.698] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x13fb, lpOverlapped=0x0) returned 1 [0176.700] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1400, lpOverlapped=0x0) returned 1 [0176.701] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.726] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.737] CloseHandle (hObject=0x104) returned 1 [0176.737] CloseHandle (hObject=0x100) returned 1 [0176.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\506561636F636B.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\506561636f636b.jpg")) returned 0 [0176.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\506561636F636B.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\506561636f636b.jpg")) returned 0x2020 [0176.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0x324fd8 [0176.738] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0 [0176.738] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0176.738] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 1 [0176.739] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 0xffffffff [0176.739] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0176.740] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0176.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0176.740] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f70, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0176.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f70) returned 0x10ab [0176.740] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0176.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\526F736573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\526f736573.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0176.741] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0176.741] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0176.742] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0176.872] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe9, lpOverlapped=0x0) returned 1 [0176.873] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0176.874] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.899] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.910] CloseHandle (hObject=0x100) returned 1 [0176.910] CloseHandle (hObject=0x104) returned 1 [0176.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\526F736573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\526f736573.htm")) returned 0 [0176.911] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\526F736573.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\526f736573.htm")) returned 0x2020 [0176.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Roses.htm", cAlternateFileName="")) returned 0x324fd8 [0176.911] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Roses.htm", cAlternateFileName="")) returned 0 [0176.911] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0176.911] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm")) returned 1 [0176.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm")) returned 0xffffffff [0176.912] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0176.913] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0176.913] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.913] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0176.913] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0176.913] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0176.913] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a010) returned 0x10ab [0176.913] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0176.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\526F736573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\526f736573.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0176.916] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x780 [0176.916] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0176.916] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0177.006] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x780, lpOverlapped=0x0) returned 1 [0177.013] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x790, lpOverlapped=0x0) returned 1 [0177.014] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.038] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.049] CloseHandle (hObject=0x104) returned 1 [0177.049] CloseHandle (hObject=0x100) returned 1 [0177.050] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\526F736573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\526f736573.jpg")) returned 0 [0177.051] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\526F736573.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\526f736573.jpg")) returned 0x2020 [0177.051] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Roses.jpg", cAlternateFileName="")) returned 0x324fd8 [0177.051] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Roses.jpg", cAlternateFileName="")) returned 0 [0177.051] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0177.051] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 1 [0177.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 0xffffffff [0177.052] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0177.053] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.053] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.053] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.053] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28a18, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.053] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.053] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28a18) returned 0x10ab [0177.053] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.053] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536861646573206F6620426C7565.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536861646573206f6620426c7565.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0177.054] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0177.054] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0177.054] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0177.147] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0177.148] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0177.149] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.172] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.183] CloseHandle (hObject=0x100) returned 1 [0177.183] CloseHandle (hObject=0x104) returned 1 [0177.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536861646573206F6620426C7565.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536861646573206f6620426c7565.htm")) returned 0 [0177.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536861646573206F6620426C7565.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536861646573206f6620426c7565.htm")) returned 0x2020 [0177.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 0x324fd8 [0177.185] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 0 [0177.185] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0177.185] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm")) returned 1 [0177.186] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm")) returned 0xffffffff [0177.186] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0177.186] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.186] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.186] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.186] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a428, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.186] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.186] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a428) returned 0x10ab [0177.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0177.187] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5368616465734F66426C7565.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5368616465734f66426c7565.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.187] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127e [0177.187] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0177.188] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0177.260] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x127e, lpOverlapped=0x0) returned 1 [0177.262] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1280, lpOverlapped=0x0) returned 1 [0177.263] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.285] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.296] CloseHandle (hObject=0x104) returned 1 [0177.297] CloseHandle (hObject=0x100) returned 1 [0177.297] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5368616465734F66426C7565.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5368616465734f66426c7565.jpg")) returned 0 [0177.298] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5368616465734F66426C7565.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5368616465734f66426c7565.jpg")) returned 0x2020 [0177.298] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0x324fd8 [0177.298] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0 [0177.298] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0177.298] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 1 [0177.299] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 0xffffffff [0177.299] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0177.299] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.299] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.299] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.299] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a660, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.299] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.299] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a660) returned 0x10ab [0177.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536F667420426C7565.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536f667420426c7565.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0177.300] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0177.301] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0177.301] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0177.402] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe8, lpOverlapped=0x0) returned 1 [0177.403] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0177.404] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.426] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.437] CloseHandle (hObject=0x100) returned 1 [0177.437] CloseHandle (hObject=0x104) returned 1 [0177.437] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536F667420426C7565.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536f667420426c7565.htm")) returned 0 [0177.438] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536F667420426C7565.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536f667420426c7565.htm")) returned 0x2020 [0177.438] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 0x324fd8 [0177.438] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 0 [0177.438] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0177.438] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm")) returned 1 [0177.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm")) returned 0xffffffff [0177.439] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0177.439] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.439] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.439] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.439] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a880, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.439] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.439] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a880) returned 0x10ab [0177.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0177.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536F6674426C7565.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536f6674426c7565.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.441] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2949 [0177.441] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0177.441] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0177.522] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2949, lpOverlapped=0x0) returned 1 [0177.529] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2950, lpOverlapped=0x0) returned 1 [0177.531] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.554] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.565] CloseHandle (hObject=0x104) returned 1 [0177.565] CloseHandle (hObject=0x100) returned 1 [0177.565] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536F6674426C7565.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536f6674426c7565.jpg")) returned 0 [0177.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\536F6674426C7565.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\536f6674426c7565.jpg")) returned 0x2020 [0177.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0x324fd8 [0177.566] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0 [0177.566] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0177.566] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 1 [0177.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 0xffffffff [0177.567] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0177.568] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.568] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.568] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.568] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.568] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.568] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa9c) returned 0x10ab [0177.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5374617273.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5374617273.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0177.569] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0177.569] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0177.570] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0177.681] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe6, lpOverlapped=0x0) returned 1 [0177.682] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0177.683] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.705] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.716] CloseHandle (hObject=0x100) returned 1 [0177.716] CloseHandle (hObject=0x104) returned 1 [0177.717] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5374617273.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5374617273.htm")) returned 0 [0177.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5374617273.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5374617273.htm")) returned 0x2020 [0177.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Stars.htm", cAlternateFileName="")) returned 0x324fd8 [0177.717] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Stars.htm", cAlternateFileName="")) returned 0 [0177.718] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0177.718] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm")) returned 1 [0177.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm")) returned 0xffffffff [0177.718] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0177.719] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.719] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.719] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.719] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abf0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.719] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.719] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abf0) returned 0x10ab [0177.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0177.720] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5374617273.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5374617273.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.720] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d51 [0177.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0177.720] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0177.818] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d51, lpOverlapped=0x0) returned 1 [0177.820] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d60, lpOverlapped=0x0) returned 1 [0177.821] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.844] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.856] CloseHandle (hObject=0x104) returned 1 [0177.856] CloseHandle (hObject=0x100) returned 1 [0177.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5374617273.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5374617273.jpg")) returned 0 [0177.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\5374617273.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\5374617273.jpg")) returned 0x2020 [0177.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0x324fd8 [0177.857] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0177.857] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0177.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 1 [0177.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 0xffffffff [0177.858] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0177.858] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0177.858] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x706a6d67, dwReserved1=0x776d7467, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0177.859] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.859] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.859] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.859] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28af8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.859] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.859] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28af8) returned 0x10ab [0177.859] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0177.860] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.860] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.860] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.860] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.860] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.860] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae48) returned 0x10ab [0177.860] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0177.860] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0177.860] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0177.860] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0177.861] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0177.861] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="12.0", cAlternateFileName="")) returned 1 [0177.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0177.861] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0177.861] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0177.862] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.862] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.862] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.862] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28cf8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.862] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.862] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28cf8) returned 0x10ab [0177.862] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0177.862] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.862] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.862] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.862] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28d84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.862] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.862] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28d84) returned 0x10ab [0177.862] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0177.863] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0177.863] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="12.0", cAlternateFileName="")) returned 0 [0177.863] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0177.863] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0177.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0177.863] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0177.863] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0177.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0177.864] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 1 [0177.864] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 0 [0177.864] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0177.864] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0177.864] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0177.864] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.864] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0177.864] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28e70, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0177.864] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0177.864] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28e70) returned 0x10ab [0177.864] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0177.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\53657474696E6773.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\53657474696e6773.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.866] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54 [0177.866] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0177.866] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0177.965] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x54, lpOverlapped=0x0) returned 1 [0177.966] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x60, lpOverlapped=0x0) returned 1 [0177.967] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.989] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.000] CloseHandle (hObject=0xfc) returned 1 [0178.000] CloseHandle (hObject=0x100) returned 1 [0178.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\53657474696E6773.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\53657474696e6773.ini")) returned 0 [0178.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\53657474696E6773.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\53657474696e6773.ini")) returned 0x2020 [0178.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Settings.ini", cAlternateFileName="")) returned 0x324f98 [0178.001] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0178.001] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0178.001] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1 [0178.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0xffffffff [0178.002] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0178.002] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0178.002] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0178.003] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0178.003] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0178.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0178.003] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0178.003] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 0 [0178.003] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0178.003] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0178.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0178.005] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0178.005] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="Firefox", cAlternateFileName="")) returned 1 [0178.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0178.006] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.006] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0178.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0178.006] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.007] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0178.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0178.009] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.009] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0178.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0178.012] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.012] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0178.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.013] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.013] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="98", cAlternateFileName="")) returned 1 [0178.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.014] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.014] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 1 [0178.014] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.014] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.014] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.014] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.014] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.015] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291e8) returned 0x10ab [0178.015] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 0 [0178.015] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.015] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 1 [0178.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.016] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.016] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="C3B7Bd01", cAlternateFileName="")) returned 1 [0178.016] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.017] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad94, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.017] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad94) returned 0x10ab [0178.017] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="C3B7Bd01", cAlternateFileName="")) returned 0 [0178.017] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.017] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 0 [0178.017] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.017] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0178.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.017] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.017] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B", cAlternateFileName="")) returned 1 [0178.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.018] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.018] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="FCBF5d01", cAlternateFileName="")) returned 1 [0178.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.018] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291bc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291bc) returned 0x10ab [0178.018] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="FCBF5d01", cAlternateFileName="")) returned 0 [0178.018] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.018] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2", cAlternateFileName="")) returned 1 [0178.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.020] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.020] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="0B619d01", cAlternateFileName="")) returned 1 [0178.020] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.020] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.020] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.020] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae20, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.020] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.020] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae20) returned 0x10ab [0178.020] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="0B619d01", cAlternateFileName="")) returned 0 [0178.020] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.020] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 1 [0178.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.021] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.021] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CBD4Dd01", cAlternateFileName="")) returned 1 [0178.021] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.021] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.021] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.021] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291bc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.021] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.021] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291bc) returned 0x10ab [0178.021] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CBD4Dd01", cAlternateFileName="")) returned 0 [0178.021] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.021] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 0 [0178.021] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.021] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0178.021] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.023] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.023] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0178.023] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.023] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3", cAlternateFileName="")) returned 1 [0178.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.026] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.026] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 1 [0178.026] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.060] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.061] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="1D8FDd01", cAlternateFileName="")) returned 1 [0178.064] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.064] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.067] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.067] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.067] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.067] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac8c) returned 0x10ab [0178.067] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="1D8FDd01", cAlternateFileName="")) returned 0 [0178.067] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.067] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 0 [0178.067] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.067] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1 [0178.067] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.068] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.068] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0178.068] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.068] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5", cAlternateFileName="")) returned 1 [0178.068] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.069] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.070] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0178.070] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.070] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1 [0178.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.070] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.070] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0178.070] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.070] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7", cAlternateFileName="")) returned 1 [0178.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.071] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.071] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0178.071] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.071] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8", cAlternateFileName="")) returned 1 [0178.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.072] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.072] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0178.072] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.072] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9", cAlternateFileName="")) returned 1 [0178.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.073] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.073] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0178.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.073] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.073] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="16A09d01", cAlternateFileName="")) returned 1 [0178.074] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.074] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.074] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.074] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2947c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.074] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.074] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2947c) returned 0x10ab [0178.074] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="16A09d01", cAlternateFileName="")) returned 0 [0178.074] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.074] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C", cAlternateFileName="")) returned 1 [0178.074] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.074] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.074] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="24B53d01", cAlternateFileName="")) returned 1 [0178.075] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.075] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.075] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.075] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2952c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.075] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.075] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2952c) returned 0x10ab [0178.075] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="24B53d01", cAlternateFileName="")) returned 0 [0178.075] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.075] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="61", cAlternateFileName="")) returned 1 [0178.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.075] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.075] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="28E95d01", cAlternateFileName="")) returned 1 [0178.076] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.076] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.076] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.076] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29544, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.076] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.076] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29544) returned 0x10ab [0178.076] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="28E95d01", cAlternateFileName="")) returned 0 [0178.076] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.076] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 1 [0178.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.078] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.078] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="F17B2d01", cAlternateFileName="")) returned 1 [0178.078] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.078] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.078] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.078] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29294, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.078] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.078] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29294) returned 0x10ab [0178.078] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="F17B2d01", cAlternateFileName="")) returned 0 [0178.078] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.078] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 0 [0178.078] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.078] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A", cAlternateFileName="")) returned 1 [0178.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.079] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.079] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0178.079] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.079] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B", cAlternateFileName="")) returned 1 [0178.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.080] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.080] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0178.080] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.080] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0178.080] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.080] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.080] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 1 [0178.080] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.081] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.081] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="9DCB7d01", cAlternateFileName="")) returned 1 [0178.081] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.081] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.081] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.081] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29474, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.081] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.081] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29474) returned 0x10ab [0178.081] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="9DCB7d01", cAlternateFileName="")) returned 0 [0178.081] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.081] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 0 [0178.081] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.081] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D", cAlternateFileName="")) returned 1 [0178.081] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.083] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.083] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 1 [0178.083] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.084] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.084] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="71469d01", cAlternateFileName="")) returned 1 [0178.084] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.084] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.084] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.084] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae5c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.084] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.084] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae5c) returned 0x10ab [0178.085] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="71469d01", cAlternateFileName="")) returned 0 [0178.085] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.087] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 0 [0178.087] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.087] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E", cAlternateFileName="")) returned 1 [0178.087] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.087] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.087] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 1 [0178.087] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.087] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.087] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="885EEd01", cAlternateFileName="")) returned 1 [0178.088] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.088] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2938c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2938c) returned 0x10ab [0178.088] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="885EEd01", cAlternateFileName="")) returned 0 [0178.088] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.088] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 0 [0178.088] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.088] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F", cAlternateFileName="")) returned 1 [0178.088] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0178.089] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.089] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="23", cAlternateFileName="")) returned 1 [0178.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.090] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.090] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="7E0FEd01", cAlternateFileName="")) returned 1 [0178.090] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.090] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.090] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.090] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae5c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.090] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.090] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae5c) returned 0x10ab [0178.090] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="7E0FEd01", cAlternateFileName="")) returned 0 [0178.090] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.090] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 1 [0178.090] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName=".", cAlternateFileName="")) returned 0x325098 [0178.091] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="..", cAlternateFileName="")) returned 1 [0178.091] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="ECB2Dd01", cAlternateFileName="")) returned 1 [0178.092] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.092] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.092] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.092] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af34, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.092] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.092] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af34) returned 0x10ab [0178.092] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="ECB2Dd01", cAlternateFileName="")) returned 0 [0178.092] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0178.092] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 0 [0178.092] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.092] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851226b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_001_", cAlternateFileName="_CACHE~2")) returned 1 [0178.092] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.092] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.093] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.093] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c293ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.093] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.093] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c293ac) returned 0x10ab [0178.093] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851e0d90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="_CACHE_002_", cAlternateFileName="_CACHE~3")) returned 1 [0178.093] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.093] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.093] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.093] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.093] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.093] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acb4) returned 0x10ab [0178.093] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8529f470, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="_CACHE_003_", cAlternateFileName="_CACHE~4")) returned 1 [0178.093] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.093] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.093] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.094] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c293d4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c293d4) returned 0x10ab [0178.094] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 1 [0178.094] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.094] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acb4) returned 0x10ab [0178.094] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 0 [0178.094] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0178.094] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1 [0178.094] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName=".", cAlternateFileName="")) returned 0x325018 [0178.097] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="..", cAlternateFileName="")) returned 1 [0178.097] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 1 [0178.097] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.097] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.097] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291d4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.097] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.098] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291d4) returned 0x10ab [0178.098] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 0 [0178.098] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0178.098] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~2")) returned 1 [0178.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName=".", cAlternateFileName="")) returned 0x325018 [0178.102] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="..", cAlternateFileName="")) returned 1 [0178.102] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x825fd7f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x825fd7f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x825fd7f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="test-malware-simple.cache", cAlternateFileName="TEST-M~1.CAC")) returned 1 [0178.102] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.102] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aca0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aca0) returned 0x10ab [0178.102] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8234ff30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="test-malware-simple.pset", cAlternateFileName="TEST-M~1.PSE")) returned 1 [0178.102] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.102] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.103] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291f0) returned 0x10ab [0178.103] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82376090, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 1 [0178.103] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.103] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.103] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.103] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aca4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.103] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.103] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aca4) returned 0x10ab [0178.103] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82695d70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82695d70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82695d70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="test-phish-simple.cache", cAlternateFileName="TEST-P~1.CAC")) returned 1 [0178.103] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.103] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.103] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.103] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aca0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.103] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.103] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aca0) returned 0x10ab [0178.104] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="test-phish-simple.pset", cAlternateFileName="TEST-P~1.PSE")) returned 1 [0178.104] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.104] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.104] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.104] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d4c) returned 0x10ab [0178.104] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 1 [0178.104] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.104] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.104] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aca4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.104] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aca4) returned 0x10ab [0178.105] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 0 [0178.105] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0178.105] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706d6973, dwReserved1=0x732e656c, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1 [0178.105] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName=".", cAlternateFileName="")) returned 0x325018 [0178.108] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="..", cAlternateFileName="")) returned 1 [0178.108] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 1 [0178.109] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.109] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.109] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.109] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c292a0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.109] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.109] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c292a0) returned 0x10ab [0178.109] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 0 [0178.109] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0178.109] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e342e65, dwReserved1=0x7474696c, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0178.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName=".", cAlternateFileName="")) returned 0x325018 [0178.112] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="..", cAlternateFileName="")) returned 1 [0178.112] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 1 [0178.113] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.113] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.113] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.113] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291d0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.113] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.113] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291d0) returned 0x10ab [0178.116] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0178.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\3463633837633134303938313962663036663432623738326434393032623266.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\3463633837633134303938313962663036663432623738326434393032623266.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0178.118] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b0 [0178.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0178.118] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0178.194] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x40b0, lpOverlapped=0x0) returned 1 [0178.237] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x40c0, lpOverlapped=0x0) returned 1 [0178.238] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.261] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.272] CloseHandle (hObject=0x10c) returned 1 [0178.272] CloseHandle (hObject=0x108) returned 1 [0178.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\3463633837633134303938313962663036663432623738326434393032623266.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\3463633837633134303938313962663036663432623738326434393032623266.png")) returned 0 [0178.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\3463633837633134303938313962663036663432623738326434393032623266.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\3463633837633134303938313962663036663432623738326434393032623266.png")) returned 0x2020 [0178.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 0x325058 [0178.273] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 0 [0178.274] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.274] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 1 [0178.275] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 0xffffffff [0178.275] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 1 [0178.275] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.275] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.275] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.275] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c280cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.275] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.275] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c280cc) returned 0x10ab [0178.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0178.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\6261313832626364313331663166336336623666626262316261303738333431.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\6261313832626364313331663166336336623666626262316261303738333431.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0178.276] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b0 [0178.276] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0178.277] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0178.364] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x40b0, lpOverlapped=0x0) returned 1 [0178.366] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x40c0, lpOverlapped=0x0) returned 1 [0178.368] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.409] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.420] CloseHandle (hObject=0x108) returned 1 [0178.420] CloseHandle (hObject=0x10c) returned 1 [0178.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\6261313832626364313331663166336336623666626262316261303738333431.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\6261313832626364313331663166336336623666626262316261303738333431.png")) returned 0 [0178.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\6261313832626364313331663166336336623666626262316261303738333431.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\6261313832626364313331663166336336623666626262316261303738333431.png")) returned 0x2020 [0178.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 0x325058 [0178.421] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 0 [0178.421] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.421] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 1 [0178.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 0xffffffff [0178.422] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 1 [0178.423] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.423] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.423] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.423] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29410, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.423] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.423] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29410) returned 0x10ab [0178.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0178.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\6365386330343533353839323136613637636464623530323834666266653864.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\6365386330343533353839323136613637636464623530323834666266653864.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0178.424] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c362 [0178.425] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0178.425] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0178.497] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c362, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x1c362, lpOverlapped=0x0) returned 1 [0178.502] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c370, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x1c370, lpOverlapped=0x0) returned 1 [0178.504] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.527] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.538] CloseHandle (hObject=0x10c) returned 1 [0178.538] CloseHandle (hObject=0x108) returned 1 [0178.538] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\6365386330343533353839323136613637636464623530323834666266653864.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\6365386330343533353839323136613637636464623530323834666266653864.png")) returned 0 [0178.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\6365386330343533353839323136613637636464623530323834666266653864.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\6365386330343533353839323136613637636464623530323834666266653864.png")) returned 0x2020 [0178.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0x325058 [0178.539] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0 [0178.539] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0178.539] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 1 [0178.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 0xffffffff [0178.541] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0 [0178.541] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0178.541] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x61363132, dwReserved1=0x64633736, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1 [0178.541] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.541] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.541] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.541] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28620, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.541] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.541] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28620) returned 0x10ab [0178.541] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x61363132, dwReserved1=0x64633736, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0 [0178.541] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0178.542] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0178.542] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0178.542] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0178.542] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0178.542] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="updates", cAlternateFileName="")) returned 1 [0178.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0178.542] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x74, cFileName="..", cAlternateFileName="")) returned 1 [0178.542] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x74, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0178.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0178.544] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.544] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1 [0178.545] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.545] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.545] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.545] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c287dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.545] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.545] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c287dc) returned 0x10ab [0178.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0178.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\6163746976652D757064617465.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\6163746976652d757064617465.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0178.546] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x464 [0178.546] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0178.547] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0178.637] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x464, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x464, lpOverlapped=0x0) returned 1 [0178.639] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x470, lpOverlapped=0x0) returned 1 [0178.640] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.662] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.673] CloseHandle (hObject=0xfc) returned 1 [0178.673] CloseHandle (hObject=0x104) returned 1 [0178.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\6163746976652D757064617465.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\6163746976652d757064617465.xml")) returned 0 [0178.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\6163746976652D757064617465.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\6163746976652d757064617465.xml")) returned 0x2020 [0178.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 0x324fd8 [0178.674] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 0 [0178.674] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0178.674] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml")) returned 1 [0178.678] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml")) returned 0xffffffff [0178.678] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="updates", cAlternateFileName="")) returned 1 [0178.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe00bc, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0178.682] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe00bc, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0178.682] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe00bc, dwReserved1=0x31e3e0, cFileName="0", cAlternateFileName="")) returned 1 [0178.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName=".", cAlternateFileName="")) returned 0x325018 [0178.683] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="..", cAlternateFileName="")) returned 1 [0178.683] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x300000, dwReserved1=0x31e560, cFileName="update.mar", cAlternateFileName="")) returned 1 [0178.683] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.683] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.683] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.683] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28d94, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.683] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.683] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28d94) returned 0x10ab [0178.683] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 1 [0178.684] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.684] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.684] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.684] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28e5c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.684] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.684] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28e5c) returned 0x10ab [0178.684] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0 [0178.684] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0178.684] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe00bc, dwReserved1=0x31e3e0, cFileName="0", cAlternateFileName="")) returned 0 [0178.684] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0178.684] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="updates.xml", cAlternateFileName="")) returned 1 [0178.684] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.684] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.684] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.685] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28f14, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.685] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.685] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28f14) returned 0x10ab [0178.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0178.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\75706461746573.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\75706461746573.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0178.686] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39 [0178.686] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0178.686] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0178.783] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x39, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x39, lpOverlapped=0x0) returned 1 [0178.784] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x40, lpOverlapped=0x0) returned 1 [0178.785] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.815] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.826] CloseHandle (hObject=0x104) returned 1 [0178.826] CloseHandle (hObject=0xfc) returned 1 [0178.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\75706461746573.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\75706461746573.xml")) returned 0 [0178.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\75706461746573.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\75706461746573.xml")) returned 0x2020 [0178.828] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="updates.xml", cAlternateFileName="")) returned 0x324fd8 [0178.828] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="updates.xml", cAlternateFileName="")) returned 0 [0178.828] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0178.828] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml")) returned 1 [0178.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml")) returned 0xffffffff [0178.829] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="updates.xml", cAlternateFileName="")) returned 0 [0178.829] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0178.829] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x74, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 0 [0178.829] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0178.829] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="updates", cAlternateFileName="")) returned 0 [0178.829] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0178.829] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xada0bf20, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0xada0bf20, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Temp", cAlternateFileName="")) returned 1 [0178.829] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xada0bf20, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0xada0bf20, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0178.829] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xada0bf20, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0xada0bf20, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="..", cAlternateFileName="")) returned 1 [0178.830] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4d974f0, ftCreationTime.dwHighDateTime=0x1d5c44b, ftLastAccessTime.dwLowDateTime=0x31a074e0, ftLastAccessTime.dwHighDateTime=0x1d5ba10, ftLastWriteTime.dwLowDateTime=0x31a074e0, ftLastWriteTime.dwHighDateTime=0x1d5ba10, nFileSizeHigh=0x0, nFileSizeLow=0x8799, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="-Rby EyEKdAjjDBO5.jpg", cAlternateFileName="-RBYEY~1.JPG")) returned 1 [0178.830] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.830] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.830] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.830] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27c8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.830] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.830] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27c8c) returned 0x10ab [0178.830] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Rby EyEKdAjjDBO5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-rby eyekdajjdbo5.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0178.831] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\2D526279204579454B64416A6A44424F35.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\2d526279204579454b64416a6a44424f35.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0178.832] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8799 [0178.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0178.832] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0178.907] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8799, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x8799, lpOverlapped=0x0) returned 1 [0178.908] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x87a0, lpOverlapped=0x0) returned 1 [0178.912] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.936] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.947] CloseHandle (hObject=0xf4) returned 1 [0178.947] CloseHandle (hObject=0x100) returned 1 [0178.947] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Rby EyEKdAjjDBO5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-rby eyekdajjdbo5.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\2D526279204579454B64416A6A44424F35.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\2d526279204579454b64416a6a44424f35.jpg")) returned 0 [0178.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\2D526279204579454B64416A6A44424F35.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\2d526279204579454b64416a6a44424f35.jpg")) returned 0x2020 [0178.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Rby EyEKdAjjDBO5.jpg", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4d974f0, ftCreationTime.dwHighDateTime=0x1d5c44b, ftLastAccessTime.dwLowDateTime=0x31a074e0, ftLastAccessTime.dwHighDateTime=0x1d5ba10, ftLastWriteTime.dwLowDateTime=0x31a074e0, ftLastWriteTime.dwHighDateTime=0x1d5ba10, nFileSizeHigh=0x0, nFileSizeLow=0x8799, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="-Rby EyEKdAjjDBO5.jpg", cAlternateFileName="-RBYEY~1.JPG")) returned 0x324f58 [0178.948] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4d974f0, ftCreationTime.dwHighDateTime=0x1d5c44b, ftLastAccessTime.dwLowDateTime=0x31a074e0, ftLastAccessTime.dwHighDateTime=0x1d5ba10, ftLastWriteTime.dwLowDateTime=0x31a074e0, ftLastWriteTime.dwHighDateTime=0x1d5ba10, nFileSizeHigh=0x0, nFileSizeLow=0x8799, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="-Rby EyEKdAjjDBO5.jpg", cAlternateFileName="-RBYEY~1.JPG")) returned 0 [0178.948] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0178.948] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Rby EyEKdAjjDBO5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-rby eyekdajjdbo5.jpg")) returned 1 [0178.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Rby EyEKdAjjDBO5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-rby eyekdajjdbo5.jpg")) returned 0xffffffff [0178.949] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe89d1aa0, ftCreationTime.dwHighDateTime=0x1d5c3d8, ftLastAccessTime.dwLowDateTime=0x2f2afc20, ftLastAccessTime.dwHighDateTime=0x1d5beb2, ftLastWriteTime.dwLowDateTime=0x2f2afc20, ftLastWriteTime.dwHighDateTime=0x1d5beb2, nFileSizeHigh=0x0, nFileSizeLow=0x15197, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="4eUccN5p-C9s.gif", cAlternateFileName="4EUCCN~1.GIF")) returned 1 [0178.950] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0178.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0178.950] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0178.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0178.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fac) returned 0x10ab [0178.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4eUccN5p-C9s.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4euccn5p-c9s.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0178.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\34655563634E35702D433973.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\34655563634e35702d433973.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0178.951] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15197 [0178.951] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0178.952] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0179.039] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x15197, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x15197, lpOverlapped=0x0) returned 1 [0179.042] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x151a0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x151a0, lpOverlapped=0x0) returned 1 [0179.044] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.067] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.077] CloseHandle (hObject=0x100) returned 1 [0179.078] CloseHandle (hObject=0xf4) returned 1 [0179.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4eUccN5p-C9s.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4euccn5p-c9s.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\34655563634E35702D433973.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\34655563634e35702d433973.gif")) returned 0 [0179.079] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\34655563634E35702D433973.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\34655563634e35702d433973.gif")) returned 0x2020 [0179.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4eUccN5p-C9s.gif", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe89d1aa0, ftCreationTime.dwHighDateTime=0x1d5c3d8, ftLastAccessTime.dwLowDateTime=0x2f2afc20, ftLastAccessTime.dwHighDateTime=0x1d5beb2, ftLastWriteTime.dwLowDateTime=0x2f2afc20, ftLastWriteTime.dwHighDateTime=0x1d5beb2, nFileSizeHigh=0x0, nFileSizeLow=0x15197, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4eUccN5p-C9s.gif", cAlternateFileName="4EUCCN~1.GIF")) returned 0x324f58 [0179.079] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe89d1aa0, ftCreationTime.dwHighDateTime=0x1d5c3d8, ftLastAccessTime.dwLowDateTime=0x2f2afc20, ftLastAccessTime.dwHighDateTime=0x1d5beb2, ftLastWriteTime.dwLowDateTime=0x2f2afc20, ftLastWriteTime.dwHighDateTime=0x1d5beb2, nFileSizeHigh=0x0, nFileSizeLow=0x15197, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4eUccN5p-C9s.gif", cAlternateFileName="4EUCCN~1.GIF")) returned 0 [0179.079] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0179.079] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4eUccN5p-C9s.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4euccn5p-c9s.gif")) returned 1 [0179.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4eUccN5p-C9s.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4euccn5p-c9s.gif")) returned 0xffffffff [0179.086] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc768270, ftCreationTime.dwHighDateTime=0x1d5b5bc, ftLastAccessTime.dwLowDateTime=0x9bf2a580, ftLastAccessTime.dwHighDateTime=0x1d5c54a, ftLastWriteTime.dwLowDateTime=0x9bf2a580, ftLastWriteTime.dwHighDateTime=0x1d5c54a, nFileSizeHigh=0x0, nFileSizeLow=0x672c, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="5u-igE_ojlI.ots", cAlternateFileName="5U-IGE~1.OTS")) returned 1 [0179.087] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.087] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.087] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.087] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.087] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.087] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29420) returned 0x10ab [0179.087] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ab23240, ftCreationTime.dwHighDateTime=0x1d5bd60, ftLastAccessTime.dwLowDateTime=0x56d058a0, ftLastAccessTime.dwHighDateTime=0x1d5bd91, ftLastWriteTime.dwLowDateTime=0x56d058a0, ftLastWriteTime.dwHighDateTime=0x1d5bd91, nFileSizeHigh=0x0, nFileSizeLow=0x115cb, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="5vAlEN.avi", cAlternateFileName="")) returned 1 [0179.088] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.088] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c294e0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c294e0) returned 0x10ab [0179.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5vAlEN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5valen.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3576416C454E.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3576416c454e.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0179.089] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115cb [0179.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0179.090] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0179.178] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x115cb, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x115cb, lpOverlapped=0x0) returned 1 [0179.180] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x115d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x115d0, lpOverlapped=0x0) returned 1 [0179.182] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.205] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.216] CloseHandle (hObject=0xf4) returned 1 [0179.216] CloseHandle (hObject=0x100) returned 1 [0179.216] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5vAlEN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5valen.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3576416C454E.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3576416c454e.avi")) returned 0 [0179.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3576416C454E.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3576416c454e.avi")) returned 0x2020 [0179.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5vAlEN.avi", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ab23240, ftCreationTime.dwHighDateTime=0x1d5bd60, ftLastAccessTime.dwLowDateTime=0x56d058a0, ftLastAccessTime.dwHighDateTime=0x1d5bd91, ftLastWriteTime.dwLowDateTime=0x56d058a0, ftLastWriteTime.dwHighDateTime=0x1d5bd91, nFileSizeHigh=0x0, nFileSizeLow=0x115cb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5vAlEN.avi", cAlternateFileName="")) returned 0x324f58 [0179.217] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ab23240, ftCreationTime.dwHighDateTime=0x1d5bd60, ftLastAccessTime.dwLowDateTime=0x56d058a0, ftLastAccessTime.dwHighDateTime=0x1d5bd91, ftLastWriteTime.dwLowDateTime=0x56d058a0, ftLastWriteTime.dwHighDateTime=0x1d5bd91, nFileSizeHigh=0x0, nFileSizeLow=0x115cb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5vAlEN.avi", cAlternateFileName="")) returned 0 [0179.217] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0179.217] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5vAlEN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5valen.avi")) returned 1 [0179.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5vAlEN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5valen.avi")) returned 0xffffffff [0179.219] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54c76540, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0179.219] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.219] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.219] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.219] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.219] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.219] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e50) returned 0x10ab [0179.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0179.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\41646F626541524D.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\41646f626541524d.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.221] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fc [0179.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0179.222] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0179.310] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x2fc, lpOverlapped=0x0) returned 1 [0179.310] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x300, lpOverlapped=0x0) returned 1 [0179.311] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.334] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.345] CloseHandle (hObject=0x100) returned 1 [0179.345] CloseHandle (hObject=0xf4) returned 1 [0179.346] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\41646F626541524D.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\41646f626541524d.log")) returned 0 [0179.346] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\41646F626541524D.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\41646f626541524d.log")) returned 0x2020 [0179.346] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54c76540, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 0x324f58 [0179.347] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54c76540, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 0 [0179.347] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0179.347] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log")) returned 1 [0179.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log")) returned 0xffffffff [0179.348] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7484c5c0, ftCreationTime.dwHighDateTime=0x1d5b85f, ftLastAccessTime.dwLowDateTime=0x4af8ef0, ftLastAccessTime.dwHighDateTime=0x1d5bce3, ftLastWriteTime.dwLowDateTime=0x4af8ef0, ftLastWriteTime.dwHighDateTime=0x1d5bce3, nFileSizeHigh=0x0, nFileSizeLow=0xb8b5, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="ByAQ.wav", cAlternateFileName="")) returned 1 [0179.348] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.348] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.348] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.348] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29794, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.348] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.349] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29794) returned 0x10ab [0179.349] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ByAQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\byaq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.349] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\42794151.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\42794151.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0179.350] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb8b5 [0179.350] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0179.350] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0179.445] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb8b5, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xb8b5, lpOverlapped=0x0) returned 1 [0179.447] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb8c0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xb8c0, lpOverlapped=0x0) returned 1 [0179.448] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.471] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.482] CloseHandle (hObject=0xf4) returned 1 [0179.482] CloseHandle (hObject=0x100) returned 1 [0179.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ByAQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\byaq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\42794151.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\42794151.wav")) returned 0 [0179.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\42794151.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\42794151.wav")) returned 0x2020 [0179.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ByAQ.wav", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7484c5c0, ftCreationTime.dwHighDateTime=0x1d5b85f, ftLastAccessTime.dwLowDateTime=0x4af8ef0, ftLastAccessTime.dwHighDateTime=0x1d5bce3, ftLastWriteTime.dwLowDateTime=0x4af8ef0, ftLastWriteTime.dwHighDateTime=0x1d5bce3, nFileSizeHigh=0x0, nFileSizeLow=0xb8b5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ByAQ.wav", cAlternateFileName="")) returned 0x324f58 [0179.483] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7484c5c0, ftCreationTime.dwHighDateTime=0x1d5b85f, ftLastAccessTime.dwLowDateTime=0x4af8ef0, ftLastAccessTime.dwHighDateTime=0x1d5bce3, ftLastWriteTime.dwLowDateTime=0x4af8ef0, ftLastWriteTime.dwHighDateTime=0x1d5bce3, nFileSizeHigh=0x0, nFileSizeLow=0xb8b5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ByAQ.wav", cAlternateFileName="")) returned 0 [0179.483] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0179.483] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ByAQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\byaq.wav")) returned 1 [0179.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ByAQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\byaq.wav")) returned 0xffffffff [0179.484] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb99d910, ftCreationTime.dwHighDateTime=0x1d5c228, ftLastAccessTime.dwLowDateTime=0x5c593b30, ftLastAccessTime.dwHighDateTime=0x1d5be3a, ftLastWriteTime.dwLowDateTime=0x5c593b30, ftLastWriteTime.dwHighDateTime=0x1d5be3a, nFileSizeHigh=0x0, nFileSizeLow=0x1208f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CgWDsLpLg6nI2.mp3", cAlternateFileName="CGWDSL~1.MP3")) returned 1 [0179.484] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.484] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.484] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.485] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29794, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.485] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29794) returned 0x10ab [0179.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CgWDsLpLg6nI2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cgwdslplg6ni2.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0179.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\43675744734C704C67366E4932.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\43675744734c704c67366e4932.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.486] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1208f [0179.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0179.486] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0179.573] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1208f, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x1208f, lpOverlapped=0x0) returned 1 [0179.575] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12090, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x12090, lpOverlapped=0x0) returned 1 [0179.577] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.599] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.610] CloseHandle (hObject=0x100) returned 1 [0179.610] CloseHandle (hObject=0xf4) returned 1 [0179.610] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CgWDsLpLg6nI2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cgwdslplg6ni2.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\43675744734C704C67366E4932.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\43675744734c704c67366e4932.mp3")) returned 0 [0179.615] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\43675744734C704C67366E4932.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\43675744734c704c67366e4932.mp3")) returned 0x2020 [0179.615] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CgWDsLpLg6nI2.mp3", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb99d910, ftCreationTime.dwHighDateTime=0x1d5c228, ftLastAccessTime.dwLowDateTime=0x5c593b30, ftLastAccessTime.dwHighDateTime=0x1d5be3a, ftLastWriteTime.dwLowDateTime=0x5c593b30, ftLastWriteTime.dwHighDateTime=0x1d5be3a, nFileSizeHigh=0x0, nFileSizeLow=0x1208f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CgWDsLpLg6nI2.mp3", cAlternateFileName="CGWDSL~1.MP3")) returned 0x324f58 [0179.615] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb99d910, ftCreationTime.dwHighDateTime=0x1d5c228, ftLastAccessTime.dwLowDateTime=0x5c593b30, ftLastAccessTime.dwHighDateTime=0x1d5be3a, ftLastWriteTime.dwLowDateTime=0x5c593b30, ftLastWriteTime.dwHighDateTime=0x1d5be3a, nFileSizeHigh=0x0, nFileSizeLow=0x1208f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CgWDsLpLg6nI2.mp3", cAlternateFileName="CGWDSL~1.MP3")) returned 0 [0179.615] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0179.615] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CgWDsLpLg6nI2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cgwdslplg6ni2.mp3")) returned 1 [0179.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CgWDsLpLg6nI2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cgwdslplg6ni2.mp3")) returned 0xffffffff [0179.616] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="Cookies", cAlternateFileName="")) returned 1 [0179.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x31c838, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0179.617] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x31c838, cFileName="..", cAlternateFileName="")) returned 1 [0179.617] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x860084, dwReserved1=0x31c838, cFileName="index.dat", cAlternateFileName="")) returned 1 [0179.617] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.617] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.617] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.617] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29c08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.617] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.617] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29c08) returned 0x10ab [0179.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0179.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0179.618] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0179.618] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0179.619] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0179.706] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x4000, lpOverlapped=0x0) returned 1 [0179.777] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x4010, lpOverlapped=0x0) returned 1 [0179.778] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.800] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.811] CloseHandle (hObject=0x100) returned 1 [0179.811] CloseHandle (hObject=0xfc) returned 1 [0179.811] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\696e646578.dat")) returned 0 [0179.812] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\696e646578.dat")) returned 0x2020 [0179.812] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x324f98 [0179.812] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0179.812] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0179.812] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat")) returned 1 [0179.813] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat")) returned 0xffffffff [0179.813] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x860084, dwReserved1=0x31c838, cFileName="index.dat", cAlternateFileName="")) returned 0 [0179.813] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0179.813] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c258cc0, ftCreationTime.dwHighDateTime=0x1d5c5cf, ftLastAccessTime.dwLowDateTime=0xd38e1830, ftLastAccessTime.dwHighDateTime=0x1d5b9e2, ftLastWriteTime.dwLowDateTime=0xd38e1830, ftLastWriteTime.dwHighDateTime=0x1d5b9e2, nFileSizeHigh=0x0, nFileSizeLow=0xace9, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="efZdhp3 1.png", cAlternateFileName="EFZDHP~1.PNG")) returned 1 [0179.822] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.822] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.822] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.822] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29c08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.822] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.822] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29c08) returned 0x10ab [0179.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\efZdhp3 1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\efzdhp3 1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\65665A646870332031.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\65665a646870332031.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0179.823] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xace9 [0179.823] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0179.824] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0179.911] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xace9, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xace9, lpOverlapped=0x0) returned 1 [0179.912] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xacf0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xacf0, lpOverlapped=0x0) returned 1 [0179.914] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.937] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.948] CloseHandle (hObject=0xf4) returned 1 [0179.948] CloseHandle (hObject=0xfc) returned 1 [0179.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\efZdhp3 1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\efzdhp3 1.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\65665A646870332031.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\65665a646870332031.png")) returned 0 [0179.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\65665A646870332031.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\65665a646870332031.png")) returned 0x2020 [0179.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\efZdhp3 1.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c258cc0, ftCreationTime.dwHighDateTime=0x1d5c5cf, ftLastAccessTime.dwLowDateTime=0xd38e1830, ftLastAccessTime.dwHighDateTime=0x1d5b9e2, ftLastWriteTime.dwLowDateTime=0xd38e1830, ftLastWriteTime.dwHighDateTime=0x1d5b9e2, nFileSizeHigh=0x0, nFileSizeLow=0xace9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="efZdhp3 1.png", cAlternateFileName="EFZDHP~1.PNG")) returned 0x324f58 [0179.949] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c258cc0, ftCreationTime.dwHighDateTime=0x1d5c5cf, ftLastAccessTime.dwLowDateTime=0xd38e1830, ftLastAccessTime.dwHighDateTime=0x1d5b9e2, ftLastWriteTime.dwLowDateTime=0xd38e1830, ftLastWriteTime.dwHighDateTime=0x1d5b9e2, nFileSizeHigh=0x0, nFileSizeLow=0xace9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="efZdhp3 1.png", cAlternateFileName="EFZDHP~1.PNG")) returned 0 [0179.949] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0179.949] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\efZdhp3 1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\efzdhp3 1.png")) returned 1 [0179.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\efZdhp3 1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\efzdhp3 1.png")) returned 0xffffffff [0179.950] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ab591f0, ftCreationTime.dwHighDateTime=0x1d5b6c8, ftLastAccessTime.dwLowDateTime=0xbba55030, ftLastAccessTime.dwHighDateTime=0x1d5b6ef, ftLastWriteTime.dwLowDateTime=0xbba55030, ftLastWriteTime.dwHighDateTime=0x1d5b6ef, nFileSizeHigh=0x0, nFileSizeLow=0x56d0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="fWXFl.mp4", cAlternateFileName="")) returned 1 [0179.950] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.951] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f00) returned 0x10ab [0179.951] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0179.951] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.951] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f58) returned 0x10ab [0179.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0179.951] CloseHandle (hObject=0xffffffff) returned 0 [0179.951] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\46585341504944656275674C6F6746696C65.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\46585341504944656275674c6f6746696c65.txt")) returned 0 [0179.952] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\46585341504944656275674C6F6746696C65.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\46585341504944656275674c6f6746696c65.txt")) returned 0xffffffff [0179.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0x324f58 [0179.952] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0 [0179.952] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0179.952] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0 [0179.952] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0x80 [0179.952] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2ff5300, ftCreationTime.dwHighDateTime=0x1d5c166, ftLastAccessTime.dwLowDateTime=0x55585050, ftLastAccessTime.dwHighDateTime=0x1d5b5ca, ftLastWriteTime.dwLowDateTime=0x55585050, ftLastWriteTime.dwHighDateTime=0x1d5b5ca, nFileSizeHigh=0x0, nFileSizeLow=0x18097, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="FZqek1xwh.flv", cAlternateFileName="FZQEK1~1.FLV")) returned 1 [0179.952] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0179.952] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.952] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0179.952] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29aac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0179.952] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0179.952] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29aac) returned 0x10ab [0179.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FZqek1xwh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzqek1xwh.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0179.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\465A71656B31787768.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\465a71656b31787768.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.953] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18097 [0179.953] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0179.959] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0180.031] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18097, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x18097, lpOverlapped=0x0) returned 1 [0180.034] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x180a0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x180a0, lpOverlapped=0x0) returned 1 [0180.036] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.059] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.070] CloseHandle (hObject=0xfc) returned 1 [0180.070] CloseHandle (hObject=0xf4) returned 1 [0180.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FZqek1xwh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzqek1xwh.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\465A71656B31787768.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\465a71656b31787768.flv")) returned 0 [0180.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\465A71656B31787768.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\465a71656b31787768.flv")) returned 0x2020 [0180.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FZqek1xwh.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2ff5300, ftCreationTime.dwHighDateTime=0x1d5c166, ftLastAccessTime.dwLowDateTime=0x55585050, ftLastAccessTime.dwHighDateTime=0x1d5b5ca, ftLastWriteTime.dwLowDateTime=0x55585050, ftLastWriteTime.dwHighDateTime=0x1d5b5ca, nFileSizeHigh=0x0, nFileSizeLow=0x18097, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="FZqek1xwh.flv", cAlternateFileName="FZQEK1~1.FLV")) returned 0x324f58 [0180.071] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2ff5300, ftCreationTime.dwHighDateTime=0x1d5c166, ftLastAccessTime.dwLowDateTime=0x55585050, ftLastAccessTime.dwHighDateTime=0x1d5b5ca, ftLastWriteTime.dwLowDateTime=0x55585050, ftLastWriteTime.dwHighDateTime=0x1d5b5ca, nFileSizeHigh=0x0, nFileSizeLow=0x18097, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="FZqek1xwh.flv", cAlternateFileName="FZQEK1~1.FLV")) returned 0 [0180.071] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0180.071] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FZqek1xwh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzqek1xwh.flv")) returned 1 [0180.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FZqek1xwh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzqek1xwh.flv")) returned 0xffffffff [0180.073] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="History", cAlternateFileName="")) returned 1 [0180.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c838, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0180.074] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c838, cFileName="..", cAlternateFileName="")) returned 1 [0180.074] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c838, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0180.074] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0180.074] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0180.074] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0180.075] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.075] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.075] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.075] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f24, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.075] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.075] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f24) returned 0x10ab [0180.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0180.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0180.076] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0180.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0180.076] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0180.163] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x91, lpOverlapped=0x0) returned 1 [0180.164] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa0, lpOverlapped=0x0) returned 1 [0180.165] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.187] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.198] CloseHandle (hObject=0x100) returned 1 [0180.198] CloseHandle (hObject=0x104) returned 1 [0180.198] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\6465736b746f70.ini")) returned 0 [0180.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\6465736b746f70.ini")) returned 0x2020 [0180.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0180.199] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0180.199] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0180.199] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini")) returned 1 [0180.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0180.200] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0180.201] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.201] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.201] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.201] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f24, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.201] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.201] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f24) returned 0x10ab [0180.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0180.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0180.202] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0180.202] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0180.202] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0180.289] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x4000, lpOverlapped=0x0) returned 1 [0180.291] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x4010, lpOverlapped=0x0) returned 1 [0180.292] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.314] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.326] CloseHandle (hObject=0x104) returned 1 [0180.326] CloseHandle (hObject=0x100) returned 1 [0180.326] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\696e646578.dat")) returned 0 [0180.327] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\696e646578.dat")) returned 0x2020 [0180.327] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x324fd8 [0180.327] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0180.327] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0180.327] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat")) returned 1 [0180.329] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat")) returned 0xffffffff [0180.329] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0180.329] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0180.329] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c838, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0180.329] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0180.329] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaecb68d0, ftCreationTime.dwHighDateTime=0x1d5c2d0, ftLastAccessTime.dwLowDateTime=0x5eeefb30, ftLastAccessTime.dwHighDateTime=0x1d5ba5e, ftLastWriteTime.dwLowDateTime=0x5eeefb30, ftLastWriteTime.dwHighDateTime=0x1d5ba5e, nFileSizeHigh=0x0, nFileSizeLow=0xf58b, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="hLRs53PuvZbM.ots", cAlternateFileName="HLRS53~1.OTS")) returned 1 [0180.329] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.329] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.330] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f70, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f70) returned 0x10ab [0180.330] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc9eba0, ftCreationTime.dwHighDateTime=0x1d5bd5d, ftLastAccessTime.dwLowDateTime=0x4f855ba0, ftLastAccessTime.dwHighDateTime=0x1d5bae3, ftLastWriteTime.dwLowDateTime=0x4f855ba0, ftLastWriteTime.dwHighDateTime=0x1d5bae3, nFileSizeHigh=0x0, nFileSizeLow=0x11fbd, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="iPBu7Rb.flv", cAlternateFileName="")) returned 1 [0180.330] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.330] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a240, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.330] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.330] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a240) returned 0x10ab [0180.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iPBu7Rb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ipbu7rb.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\69504275375262.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\69504275375262.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0180.331] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11fbd [0180.331] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0180.332] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0180.423] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11fbd, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x11fbd, lpOverlapped=0x0) returned 1 [0180.425] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11fc0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x11fc0, lpOverlapped=0x0) returned 1 [0180.426] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.449] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.465] CloseHandle (hObject=0xf4) returned 1 [0180.465] CloseHandle (hObject=0xfc) returned 1 [0180.465] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iPBu7Rb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ipbu7rb.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\69504275375262.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\69504275375262.flv")) returned 0 [0180.467] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\69504275375262.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\69504275375262.flv")) returned 0x2020 [0180.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iPBu7Rb.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc9eba0, ftCreationTime.dwHighDateTime=0x1d5bd5d, ftLastAccessTime.dwLowDateTime=0x4f855ba0, ftLastAccessTime.dwHighDateTime=0x1d5bae3, ftLastWriteTime.dwLowDateTime=0x4f855ba0, ftLastWriteTime.dwHighDateTime=0x1d5bae3, nFileSizeHigh=0x0, nFileSizeLow=0x11fbd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="iPBu7Rb.flv", cAlternateFileName="")) returned 0x324f58 [0180.467] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc9eba0, ftCreationTime.dwHighDateTime=0x1d5bd5d, ftLastAccessTime.dwLowDateTime=0x4f855ba0, ftLastAccessTime.dwHighDateTime=0x1d5bae3, ftLastWriteTime.dwLowDateTime=0x4f855ba0, ftLastWriteTime.dwHighDateTime=0x1d5bae3, nFileSizeHigh=0x0, nFileSizeLow=0x11fbd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="iPBu7Rb.flv", cAlternateFileName="")) returned 0 [0180.467] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0180.467] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iPBu7Rb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ipbu7rb.flv")) returned 1 [0180.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iPBu7Rb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ipbu7rb.flv")) returned 0xffffffff [0180.469] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc071e0, ftCreationTime.dwHighDateTime=0x1d5bfcf, ftLastAccessTime.dwLowDateTime=0xc7c25450, ftLastAccessTime.dwHighDateTime=0x1d5c435, ftLastWriteTime.dwLowDateTime=0xc7c25450, ftLastWriteTime.dwHighDateTime=0x1d5c435, nFileSizeHigh=0x0, nFileSizeLow=0x1c5c, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="KUAafS_MYZhW.mkv", cAlternateFileName="KUAAFS~1.MKV")) returned 1 [0180.469] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.470] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.470] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.470] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a49c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.470] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.470] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a49c) returned 0x10ab [0180.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KUAafS_MYZhW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kuaafs_myzhw.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0180.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4B55416166535F4D595A6857.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4b55416166535f4d595a6857.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.471] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c5c [0180.471] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0180.471] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0180.558] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c5c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x1c5c, lpOverlapped=0x0) returned 1 [0180.559] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x1c60, lpOverlapped=0x0) returned 1 [0180.560] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.584] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.595] CloseHandle (hObject=0xfc) returned 1 [0180.595] CloseHandle (hObject=0xf4) returned 1 [0180.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KUAafS_MYZhW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kuaafs_myzhw.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4B55416166535F4D595A6857.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4b55416166535f4d595a6857.mkv")) returned 0 [0180.596] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4B55416166535F4D595A6857.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4b55416166535f4d595a6857.mkv")) returned 0x2020 [0180.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KUAafS_MYZhW.mkv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc071e0, ftCreationTime.dwHighDateTime=0x1d5bfcf, ftLastAccessTime.dwLowDateTime=0xc7c25450, ftLastAccessTime.dwHighDateTime=0x1d5c435, ftLastWriteTime.dwLowDateTime=0xc7c25450, ftLastWriteTime.dwHighDateTime=0x1d5c435, nFileSizeHigh=0x0, nFileSizeLow=0x1c5c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="KUAafS_MYZhW.mkv", cAlternateFileName="KUAAFS~1.MKV")) returned 0x324f58 [0180.596] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc071e0, ftCreationTime.dwHighDateTime=0x1d5bfcf, ftLastAccessTime.dwLowDateTime=0xc7c25450, ftLastAccessTime.dwHighDateTime=0x1d5c435, ftLastWriteTime.dwLowDateTime=0xc7c25450, ftLastWriteTime.dwHighDateTime=0x1d5c435, nFileSizeHigh=0x0, nFileSizeLow=0x1c5c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="KUAafS_MYZhW.mkv", cAlternateFileName="KUAAFS~1.MKV")) returned 0 [0180.596] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0180.596] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KUAafS_MYZhW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kuaafs_myzhw.mkv")) returned 1 [0180.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KUAafS_MYZhW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kuaafs_myzhw.mkv")) returned 0xffffffff [0180.597] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99a31180, ftCreationTime.dwHighDateTime=0x1d5befa, ftLastAccessTime.dwLowDateTime=0xea969580, ftLastAccessTime.dwHighDateTime=0x1d5bf4a, ftLastWriteTime.dwLowDateTime=0xea969580, ftLastWriteTime.dwHighDateTime=0x1d5bf4a, nFileSizeHigh=0x0, nFileSizeLow=0xb44e, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="LFb5B2BTEOZ1sB_nwNZ.mkv", cAlternateFileName="LFB5B2~1.MKV")) returned 1 [0180.598] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.598] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.598] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.598] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a5fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.598] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.598] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a5fc) returned 0x10ab [0180.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LFb5B2BTEOZ1sB_nwNZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lfb5b2bteoz1sb_nwnz.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4C46623542324254454F5A3173425F6E774E5A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4c46623542324254454f5a3173425f6e774e5a.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0180.599] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb44e [0180.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0180.600] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0180.671] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb44e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xb44e, lpOverlapped=0x0) returned 1 [0180.673] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb450, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xb450, lpOverlapped=0x0) returned 1 [0180.675] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.697] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.709] CloseHandle (hObject=0xf4) returned 1 [0180.709] CloseHandle (hObject=0xfc) returned 1 [0180.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LFb5B2BTEOZ1sB_nwNZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lfb5b2bteoz1sb_nwnz.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4C46623542324254454F5A3173425F6E774E5A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4c46623542324254454f5a3173425f6e774e5a.mkv")) returned 0 [0180.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4C46623542324254454F5A3173425F6E774E5A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4c46623542324254454f5a3173425f6e774e5a.mkv")) returned 0x2020 [0180.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LFb5B2BTEOZ1sB_nwNZ.mkv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99a31180, ftCreationTime.dwHighDateTime=0x1d5befa, ftLastAccessTime.dwLowDateTime=0xea969580, ftLastAccessTime.dwHighDateTime=0x1d5bf4a, ftLastWriteTime.dwLowDateTime=0xea969580, ftLastWriteTime.dwHighDateTime=0x1d5bf4a, nFileSizeHigh=0x0, nFileSizeLow=0xb44e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="LFb5B2BTEOZ1sB_nwNZ.mkv", cAlternateFileName="LFB5B2~1.MKV")) returned 0x324f58 [0180.710] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99a31180, ftCreationTime.dwHighDateTime=0x1d5befa, ftLastAccessTime.dwLowDateTime=0xea969580, ftLastAccessTime.dwHighDateTime=0x1d5bf4a, ftLastWriteTime.dwLowDateTime=0xea969580, ftLastWriteTime.dwHighDateTime=0x1d5bf4a, nFileSizeHigh=0x0, nFileSizeLow=0xb44e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="LFb5B2BTEOZ1sB_nwNZ.mkv", cAlternateFileName="LFB5B2~1.MKV")) returned 0 [0180.710] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0180.710] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LFb5B2BTEOZ1sB_nwNZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lfb5b2bteoz1sb_nwnz.mkv")) returned 1 [0180.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LFb5B2BTEOZ1sB_nwNZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lfb5b2bteoz1sb_nwnz.mkv")) returned 0xffffffff [0180.711] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b6906e0, ftCreationTime.dwHighDateTime=0x1d5b877, ftLastAccessTime.dwLowDateTime=0xcd8f70c0, ftLastAccessTime.dwHighDateTime=0x1d5be18, ftLastWriteTime.dwLowDateTime=0xcd8f70c0, ftLastWriteTime.dwHighDateTime=0x1d5be18, nFileSizeHigh=0x0, nFileSizeLow=0xcdf, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="lRmbzc.ods", cAlternateFileName="")) returned 1 [0180.711] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.711] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.712] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a7dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a7dc) returned 0x10ab [0180.712] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x889532c0, ftCreationTime.dwHighDateTime=0x1d5c2eb, ftLastAccessTime.dwLowDateTime=0xf2320590, ftLastAccessTime.dwHighDateTime=0x1d5c00d, ftLastWriteTime.dwLowDateTime=0xf2320590, ftLastWriteTime.dwHighDateTime=0x1d5c00d, nFileSizeHigh=0x0, nFileSizeLow=0x14536, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="mih100.flv", cAlternateFileName="")) returned 1 [0180.712] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.712] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a888, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.712] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.712] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a888) returned 0x10ab [0180.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mih100.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mih100.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0180.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6D6968313030.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6d6968313030.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.713] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14536 [0180.713] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0180.714] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0180.802] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14536, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x14536, lpOverlapped=0x0) returned 1 [0180.804] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14540, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x14540, lpOverlapped=0x0) returned 1 [0180.807] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.838] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.849] CloseHandle (hObject=0xfc) returned 1 [0180.850] CloseHandle (hObject=0xf4) returned 1 [0180.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mih100.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mih100.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6D6968313030.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6d6968313030.flv")) returned 0 [0180.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6D6968313030.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6d6968313030.flv")) returned 0x2020 [0180.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mih100.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x889532c0, ftCreationTime.dwHighDateTime=0x1d5c2eb, ftLastAccessTime.dwLowDateTime=0xf2320590, ftLastAccessTime.dwHighDateTime=0x1d5c00d, ftLastWriteTime.dwLowDateTime=0xf2320590, ftLastWriteTime.dwHighDateTime=0x1d5c00d, nFileSizeHigh=0x0, nFileSizeLow=0x14536, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="mih100.flv", cAlternateFileName="")) returned 0x324f58 [0180.851] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x889532c0, ftCreationTime.dwHighDateTime=0x1d5c2eb, ftLastAccessTime.dwLowDateTime=0xf2320590, ftLastAccessTime.dwHighDateTime=0x1d5c00d, ftLastWriteTime.dwLowDateTime=0xf2320590, ftLastWriteTime.dwHighDateTime=0x1d5c00d, nFileSizeHigh=0x0, nFileSizeLow=0x14536, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="mih100.flv", cAlternateFileName="")) returned 0 [0180.851] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0180.851] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mih100.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mih100.flv")) returned 1 [0180.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mih100.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mih100.flv")) returned 0xffffffff [0180.852] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb05da6e0, ftCreationTime.dwHighDateTime=0x1d5c3a7, ftLastAccessTime.dwLowDateTime=0x4cb287e0, ftLastAccessTime.dwHighDateTime=0x1d5c10a, ftLastWriteTime.dwLowDateTime=0x4cb287e0, ftLastWriteTime.dwHighDateTime=0x1d5c10a, nFileSizeHigh=0x0, nFileSizeLow=0x6a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="n-p6.mp3", cAlternateFileName="")) returned 1 [0180.853] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.853] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fbc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fbc) returned 0x10ab [0180.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-p6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n-p6.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6E2D7036.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6e2d7036.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0180.854] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a28 [0180.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0180.854] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0180.944] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6a28, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x6a28, lpOverlapped=0x0) returned 1 [0180.945] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x6a30, lpOverlapped=0x0) returned 1 [0180.946] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.971] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.982] CloseHandle (hObject=0xf4) returned 1 [0180.982] CloseHandle (hObject=0xfc) returned 1 [0180.982] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-p6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n-p6.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6E2D7036.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6e2d7036.mp3")) returned 0 [0180.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6E2D7036.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6e2d7036.mp3")) returned 0x2020 [0180.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-p6.mp3", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb05da6e0, ftCreationTime.dwHighDateTime=0x1d5c3a7, ftLastAccessTime.dwLowDateTime=0x4cb287e0, ftLastAccessTime.dwHighDateTime=0x1d5c10a, ftLastWriteTime.dwLowDateTime=0x4cb287e0, ftLastWriteTime.dwHighDateTime=0x1d5c10a, nFileSizeHigh=0x0, nFileSizeLow=0x6a28, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="n-p6.mp3", cAlternateFileName="")) returned 0x324f58 [0180.984] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb05da6e0, ftCreationTime.dwHighDateTime=0x1d5c3a7, ftLastAccessTime.dwLowDateTime=0x4cb287e0, ftLastAccessTime.dwHighDateTime=0x1d5c10a, ftLastWriteTime.dwLowDateTime=0x4cb287e0, ftLastWriteTime.dwHighDateTime=0x1d5c10a, nFileSizeHigh=0x0, nFileSizeLow=0x6a28, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="n-p6.mp3", cAlternateFileName="")) returned 0 [0180.984] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0180.984] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-p6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n-p6.mp3")) returned 1 [0180.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-p6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n-p6.mp3")) returned 0xffffffff [0180.985] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadaec0b0, ftCreationTime.dwHighDateTime=0x1d5bbea, ftLastAccessTime.dwLowDateTime=0xac1e33b0, ftLastAccessTime.dwHighDateTime=0x1d5c500, ftLastWriteTime.dwLowDateTime=0xac1e33b0, ftLastWriteTime.dwHighDateTime=0x1d5c500, nFileSizeHigh=0x0, nFileSizeLow=0x104ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="NDQgDykER.png", cAlternateFileName="NDQGDY~1.PNG")) returned 1 [0180.986] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0180.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0180.986] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab78, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0180.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0180.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab78) returned 0x10ab [0180.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NDQgDykER.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ndqgdyker.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0180.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4E44516744796B4552.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4e44516744796b4552.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.988] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104ef [0180.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0180.988] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0181.079] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x104ef, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x104ef, lpOverlapped=0x0) returned 1 [0181.081] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x104f0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x104f0, lpOverlapped=0x0) returned 1 [0181.083] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.106] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.117] CloseHandle (hObject=0xfc) returned 1 [0181.117] CloseHandle (hObject=0xf4) returned 1 [0181.117] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NDQgDykER.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ndqgdyker.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4E44516744796B4552.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4e44516744796b4552.png")) returned 0 [0181.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4E44516744796B4552.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4e44516744796b4552.png")) returned 0x2020 [0181.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NDQgDykER.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadaec0b0, ftCreationTime.dwHighDateTime=0x1d5bbea, ftLastAccessTime.dwLowDateTime=0xac1e33b0, ftLastAccessTime.dwHighDateTime=0x1d5c500, ftLastWriteTime.dwLowDateTime=0xac1e33b0, ftLastWriteTime.dwHighDateTime=0x1d5c500, nFileSizeHigh=0x0, nFileSizeLow=0x104ef, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="NDQgDykER.png", cAlternateFileName="NDQGDY~1.PNG")) returned 0x324f58 [0181.118] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadaec0b0, ftCreationTime.dwHighDateTime=0x1d5bbea, ftLastAccessTime.dwLowDateTime=0xac1e33b0, ftLastAccessTime.dwHighDateTime=0x1d5c500, ftLastWriteTime.dwLowDateTime=0xac1e33b0, ftLastWriteTime.dwHighDateTime=0x1d5c500, nFileSizeHigh=0x0, nFileSizeLow=0x104ef, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="NDQgDykER.png", cAlternateFileName="NDQGDY~1.PNG")) returned 0 [0181.118] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0181.118] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NDQgDykER.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ndqgdyker.png")) returned 1 [0181.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NDQgDykER.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ndqgdyker.png")) returned 0xffffffff [0181.120] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d37210, ftCreationTime.dwHighDateTime=0x1d5be10, ftLastAccessTime.dwLowDateTime=0x3bb9de60, ftLastAccessTime.dwHighDateTime=0x1d5b6cf, ftLastWriteTime.dwLowDateTime=0x3bb9de60, ftLastWriteTime.dwHighDateTime=0x1d5b6cf, nFileSizeHigh=0x0, nFileSizeLow=0xabd3, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="NSinn yphKb4zt7pi.m4a", cAlternateFileName="NSINNY~1.M4A")) returned 1 [0181.120] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0181.120] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.120] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0181.120] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0181.120] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.120] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac58) returned 0x10ab [0181.121] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31c28760, ftCreationTime.dwHighDateTime=0x1d5bee8, ftLastAccessTime.dwLowDateTime=0x4ef3dc20, ftLastAccessTime.dwHighDateTime=0x1d5c259, ftLastWriteTime.dwLowDateTime=0x4ef3dc20, ftLastWriteTime.dwHighDateTime=0x1d5c259, nFileSizeHigh=0x0, nFileSizeLow=0x5e6e, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="O1bwh Vjeuc.flv", cAlternateFileName="O1BWHV~1.FLV")) returned 1 [0181.121] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0181.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0181.121] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad14, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0181.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad14) returned 0x10ab [0181.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O1bwh Vjeuc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o1bwh vjeuc.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4F3162776820566A657563.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4f3162776820566a657563.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0181.122] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e6e [0181.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0181.123] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0181.196] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5e6e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x5e6e, lpOverlapped=0x0) returned 1 [0181.198] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5e70, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x5e70, lpOverlapped=0x0) returned 1 [0181.199] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.223] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.234] CloseHandle (hObject=0xf4) returned 1 [0181.234] CloseHandle (hObject=0xfc) returned 1 [0181.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O1bwh Vjeuc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o1bwh vjeuc.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4F3162776820566A657563.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4f3162776820566a657563.flv")) returned 0 [0181.235] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4F3162776820566A657563.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4f3162776820566a657563.flv")) returned 0x2020 [0181.235] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O1bwh Vjeuc.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31c28760, ftCreationTime.dwHighDateTime=0x1d5bee8, ftLastAccessTime.dwLowDateTime=0x4ef3dc20, ftLastAccessTime.dwHighDateTime=0x1d5c259, ftLastWriteTime.dwLowDateTime=0x4ef3dc20, ftLastWriteTime.dwHighDateTime=0x1d5c259, nFileSizeHigh=0x0, nFileSizeLow=0x5e6e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="O1bwh Vjeuc.flv", cAlternateFileName="O1BWHV~1.FLV")) returned 0x324f58 [0181.236] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31c28760, ftCreationTime.dwHighDateTime=0x1d5bee8, ftLastAccessTime.dwLowDateTime=0x4ef3dc20, ftLastAccessTime.dwHighDateTime=0x1d5c259, ftLastWriteTime.dwLowDateTime=0x4ef3dc20, ftLastWriteTime.dwHighDateTime=0x1d5c259, nFileSizeHigh=0x0, nFileSizeLow=0x5e6e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="O1bwh Vjeuc.flv", cAlternateFileName="O1BWHV~1.FLV")) returned 0 [0181.236] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0181.236] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O1bwh Vjeuc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o1bwh vjeuc.flv")) returned 1 [0181.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O1bwh Vjeuc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o1bwh vjeuc.flv")) returned 0xffffffff [0181.246] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdccf310, ftCreationTime.dwHighDateTime=0x1d5ba90, ftLastAccessTime.dwLowDateTime=0x8bf2c0a0, ftLastAccessTime.dwHighDateTime=0x1d5b63d, ftLastWriteTime.dwLowDateTime=0x8bf2c0a0, ftLastWriteTime.dwHighDateTime=0x1d5b63d, nFileSizeHigh=0x0, nFileSizeLow=0x10c30, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="p45ZN1J1hUl7q-0YpxPn.swf", cAlternateFileName="P45ZN1~1.SWF")) returned 1 [0181.247] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0181.247] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.247] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0181.247] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aed0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0181.247] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.247] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aed0) returned 0x10ab [0181.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\p45ZN1J1hUl7q-0YpxPn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p45zn1j1hul7q-0ypxpn.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0181.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7034355A4E314A3168556C37712D30597078506E.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7034355a4e314a3168556c37712d30597078506e.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.248] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c30 [0181.248] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0181.249] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0181.336] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10c30, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x10c30, lpOverlapped=0x0) returned 1 [0181.338] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10c40, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x10c40, lpOverlapped=0x0) returned 1 [0181.340] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.363] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.374] CloseHandle (hObject=0xfc) returned 1 [0181.374] CloseHandle (hObject=0xf4) returned 1 [0181.374] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\p45ZN1J1hUl7q-0YpxPn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p45zn1j1hul7q-0ypxpn.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7034355A4E314A3168556C37712D30597078506E.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7034355a4e314a3168556c37712d30597078506e.swf")) returned 0 [0181.375] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7034355A4E314A3168556C37712D30597078506E.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7034355a4e314a3168556c37712d30597078506e.swf")) returned 0x2020 [0181.375] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\p45ZN1J1hUl7q-0YpxPn.swf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdccf310, ftCreationTime.dwHighDateTime=0x1d5ba90, ftLastAccessTime.dwLowDateTime=0x8bf2c0a0, ftLastAccessTime.dwHighDateTime=0x1d5b63d, ftLastWriteTime.dwLowDateTime=0x8bf2c0a0, ftLastWriteTime.dwHighDateTime=0x1d5b63d, nFileSizeHigh=0x0, nFileSizeLow=0x10c30, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="p45ZN1J1hUl7q-0YpxPn.swf", cAlternateFileName="P45ZN1~1.SWF")) returned 0x324f58 [0181.375] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdccf310, ftCreationTime.dwHighDateTime=0x1d5ba90, ftLastAccessTime.dwLowDateTime=0x8bf2c0a0, ftLastAccessTime.dwHighDateTime=0x1d5b63d, ftLastWriteTime.dwLowDateTime=0x8bf2c0a0, ftLastWriteTime.dwHighDateTime=0x1d5b63d, nFileSizeHigh=0x0, nFileSizeLow=0x10c30, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="p45ZN1J1hUl7q-0YpxPn.swf", cAlternateFileName="P45ZN1~1.SWF")) returned 0 [0181.375] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0181.375] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\p45ZN1J1hUl7q-0YpxPn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p45zn1j1hul7q-0ypxpn.swf")) returned 1 [0181.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\p45ZN1J1hUl7q-0YpxPn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p45zn1j1hul7q-0ypxpn.swf")) returned 0xffffffff [0181.376] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d52620, ftCreationTime.dwHighDateTime=0x1d5bfb2, ftLastAccessTime.dwLowDateTime=0xbf99ac40, ftLastAccessTime.dwHighDateTime=0x1d5bf3c, ftLastWriteTime.dwLowDateTime=0xbf99ac40, ftLastWriteTime.dwHighDateTime=0x1d5bf3c, nFileSizeHigh=0x0, nFileSizeLow=0x10d9c, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="QiLYEobqrlqr.mkv", cAlternateFileName="QILYEO~1.MKV")) returned 1 [0181.377] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0181.377] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.377] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0181.377] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d20, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0181.377] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.377] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d20) returned 0x10ab [0181.377] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\QiLYEobqrlqr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\qilyeobqrlqr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.377] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\51694C59456F6271726C7172.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\51694c59456f6271726c7172.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0181.378] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10d9c [0181.378] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0181.379] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0181.470] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10d9c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x10d9c, lpOverlapped=0x0) returned 1 [0181.472] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10da0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x10da0, lpOverlapped=0x0) returned 1 [0181.474] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.497] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.509] CloseHandle (hObject=0xf4) returned 1 [0181.509] CloseHandle (hObject=0xfc) returned 1 [0181.509] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\QiLYEobqrlqr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\qilyeobqrlqr.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\51694C59456F6271726C7172.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\51694c59456f6271726c7172.mkv")) returned 0 [0181.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\51694C59456F6271726C7172.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\51694c59456f6271726c7172.mkv")) returned 0x2020 [0181.510] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\QiLYEobqrlqr.mkv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d52620, ftCreationTime.dwHighDateTime=0x1d5bfb2, ftLastAccessTime.dwLowDateTime=0xbf99ac40, ftLastAccessTime.dwHighDateTime=0x1d5bf3c, ftLastWriteTime.dwLowDateTime=0xbf99ac40, ftLastWriteTime.dwHighDateTime=0x1d5bf3c, nFileSizeHigh=0x0, nFileSizeLow=0x10d9c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QiLYEobqrlqr.mkv", cAlternateFileName="QILYEO~1.MKV")) returned 0x324f58 [0181.510] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d52620, ftCreationTime.dwHighDateTime=0x1d5bfb2, ftLastAccessTime.dwLowDateTime=0xbf99ac40, ftLastAccessTime.dwHighDateTime=0x1d5bf3c, ftLastWriteTime.dwLowDateTime=0xbf99ac40, ftLastWriteTime.dwHighDateTime=0x1d5bf3c, nFileSizeHigh=0x0, nFileSizeLow=0x10d9c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QiLYEobqrlqr.mkv", cAlternateFileName="QILYEO~1.MKV")) returned 0 [0181.510] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0181.510] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\QiLYEobqrlqr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\qilyeobqrlqr.mkv")) returned 1 [0181.511] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\QiLYEobqrlqr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\qilyeobqrlqr.mkv")) returned 0xffffffff [0181.511] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0181.511] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x840082, dwReserved1=0x31c838, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0181.513] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x840082, dwReserved1=0x31c838, cFileName="..", cAlternateFileName="")) returned 1 [0181.513] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x840082, dwReserved1=0x31c838, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0181.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0181.513] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0181.513] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0181.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0181.514] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.514] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0181.515] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0181.515] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.515] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0181.515] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28054, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0181.515] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.515] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28054) returned 0x10ab [0181.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0181.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0181.516] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0181.516] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0181.516] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0181.606] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x43, lpOverlapped=0x0) returned 1 [0181.618] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x50, lpOverlapped=0x0) returned 1 [0181.618] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.641] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.652] CloseHandle (hObject=0x104) returned 1 [0181.652] CloseHandle (hObject=0x108) returned 1 [0181.652] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\6465736b746f70.ini")) returned 0 [0181.653] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\6465736b746f70.ini")) returned 0x2020 [0181.653] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0181.653] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0181.653] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0181.653] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini")) returned 1 [0181.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini")) returned 0xffffffff [0181.654] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0181.654] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0181.655] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0181.655] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0181.655] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.655] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0181.655] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29404, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0181.655] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.655] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29404) returned 0x10ab [0181.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0181.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0181.658] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0181.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0181.659] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0181.748] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0181.749] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0181.750] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.773] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.784] CloseHandle (hObject=0x100) returned 1 [0181.784] CloseHandle (hObject=0x108) returned 1 [0181.784] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\6465736b746f70.ini")) returned 0 [0181.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\6465736b746f70.ini")) returned 0x2020 [0181.785] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324fd8 [0181.785] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0181.785] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0181.785] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0181.786] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0181.786] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="index.dat", cAlternateFileName="")) returned 1 [0181.787] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0181.787] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.787] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0181.787] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29628, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0181.787] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.787] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29628) returned 0x10ab [0181.787] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0181.787] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0181.788] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0181.788] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0181.788] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0181.871] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x8000, lpOverlapped=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x8010, lpOverlapped=0x0) returned 1 [0181.874] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.896] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.907] CloseHandle (hObject=0x108) returned 1 [0181.907] CloseHandle (hObject=0x100) returned 1 [0181.908] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\696e646578.dat")) returned 0 [0181.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\696e646578.dat")) returned 0x2020 [0181.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x324fd8 [0181.909] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0181.909] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0181.909] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat")) returned 1 [0181.910] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat")) returned 0xffffffff [0181.910] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0181.910] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x31e3e0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0181.910] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x31e3e0, cFileName="..", cAlternateFileName="")) returned 1 [0181.910] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc000be, dwReserved1=0x31e3e0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0181.910] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0181.911] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.911] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0181.911] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29808, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0181.911] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0181.911] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29808) returned 0x10ab [0181.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0181.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0181.912] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0181.912] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0181.912] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0182.028] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x43, lpOverlapped=0x0) returned 1 [0182.029] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x50, lpOverlapped=0x0) returned 1 [0182.030] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.052] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.063] CloseHandle (hObject=0x108) returned 1 [0182.063] CloseHandle (hObject=0x104) returned 1 [0182.064] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\6465736b746f70.ini")) returned 0 [0182.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\6465736b746f70.ini")) returned 0x2020 [0182.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0182.064] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0182.065] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0182.065] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini")) returned 1 [0182.065] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini")) returned 0xffffffff [0182.065] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc000be, dwReserved1=0x31e3e0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0182.066] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0182.066] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0182.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0182.066] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0182.066] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0182.066] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.066] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.066] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.066] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.066] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.066] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f8c) returned 0x10ab [0182.067] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0182.067] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0182.067] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0182.067] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0182.068] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0182.155] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x43, lpOverlapped=0x0) returned 1 [0182.156] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x50, lpOverlapped=0x0) returned 1 [0182.157] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.179] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.190] CloseHandle (hObject=0x104) returned 1 [0182.190] CloseHandle (hObject=0x108) returned 1 [0182.190] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\6465736b746f70.ini")) returned 0 [0182.191] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\6465736b746f70.ini")) returned 0x2020 [0182.191] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0182.191] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0182.191] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0182.191] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini")) returned 1 [0182.192] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini")) returned 0xffffffff [0182.192] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0182.192] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0182.192] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0182.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0182.193] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0182.193] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0182.193] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.193] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.193] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.193] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0182.194] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.194] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.194] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0182.194] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0182.194] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0182.194] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0182.195] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0182.195] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0182.195] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0182.284] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x43, lpOverlapped=0x0) returned 1 [0182.285] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x50, lpOverlapped=0x0) returned 1 [0182.285] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.308] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.318] CloseHandle (hObject=0x108) returned 1 [0182.318] CloseHandle (hObject=0x104) returned 1 [0182.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\6465736b746f70.ini")) returned 0 [0182.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\6465736b746f70.ini")) returned 0x2020 [0182.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0182.319] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0182.320] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0182.320] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini")) returned 1 [0182.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini")) returned 0xffffffff [0182.320] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0182.321] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0182.321] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0182.321] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0182.321] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x840082, dwReserved1=0x31c838, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0182.321] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0182.321] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d0825c0, ftCreationTime.dwHighDateTime=0x1d5c32a, ftLastAccessTime.dwLowDateTime=0xb6f1abd0, ftLastAccessTime.dwHighDateTime=0x1d5b963, ftLastWriteTime.dwLowDateTime=0xb6f1abd0, ftLastWriteTime.dwHighDateTime=0x1d5b963, nFileSizeHigh=0x0, nFileSizeLow=0x94d2, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="tJ2WC_C4.jpg", cAlternateFileName="")) returned 1 [0182.321] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.321] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.321] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.321] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0182.322] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.322] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.322] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0182.322] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0182.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tJ2WC_C4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tj2wc_c4.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0182.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\744A3257435F4334.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\744a3257435f4334.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.323] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94d2 [0182.323] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0182.323] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0182.416] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x94d2, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x94d2, lpOverlapped=0x0) returned 1 [0182.417] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x94e0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x94e0, lpOverlapped=0x0) returned 1 [0182.419] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.441] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.452] CloseHandle (hObject=0xfc) returned 1 [0182.452] CloseHandle (hObject=0xf4) returned 1 [0182.452] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tJ2WC_C4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tj2wc_c4.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\744A3257435F4334.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\744a3257435f4334.jpg")) returned 0 [0182.453] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\744A3257435F4334.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\744a3257435f4334.jpg")) returned 0x2020 [0182.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tJ2WC_C4.jpg", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d0825c0, ftCreationTime.dwHighDateTime=0x1d5c32a, ftLastAccessTime.dwLowDateTime=0xb6f1abd0, ftLastAccessTime.dwHighDateTime=0x1d5b963, ftLastWriteTime.dwLowDateTime=0xb6f1abd0, ftLastWriteTime.dwHighDateTime=0x1d5b963, nFileSizeHigh=0x0, nFileSizeLow=0x94d2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tJ2WC_C4.jpg", cAlternateFileName="")) returned 0x324f58 [0182.453] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d0825c0, ftCreationTime.dwHighDateTime=0x1d5c32a, ftLastAccessTime.dwLowDateTime=0xb6f1abd0, ftLastAccessTime.dwHighDateTime=0x1d5b963, ftLastWriteTime.dwLowDateTime=0xb6f1abd0, ftLastWriteTime.dwHighDateTime=0x1d5b963, nFileSizeHigh=0x0, nFileSizeLow=0x94d2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tJ2WC_C4.jpg", cAlternateFileName="")) returned 0 [0182.453] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0182.453] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tJ2WC_C4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tj2wc_c4.jpg")) returned 1 [0182.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tJ2WC_C4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tj2wc_c4.jpg")) returned 0xffffffff [0182.454] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14ab8300, ftCreationTime.dwHighDateTime=0x1d5ba67, ftLastAccessTime.dwLowDateTime=0xb25de370, ftLastAccessTime.dwHighDateTime=0x1d5bf64, ftLastWriteTime.dwLowDateTime=0xb25de370, ftLastWriteTime.dwHighDateTime=0x1d5bf64, nFileSizeHigh=0x0, nFileSizeLow=0xbc03, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="V26-2dmac5vuf.mp3", cAlternateFileName="V26-2D~1.MP3")) returned 1 [0182.455] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.455] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.455] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.455] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29244, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.455] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.455] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29244) returned 0x10ab [0182.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V26-2dmac5vuf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v26-2dmac5vuf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5632362D32646D616335767566.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5632362d32646d616335767566.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0182.456] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc03 [0182.456] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0182.456] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0182.527] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbc03, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xbc03, lpOverlapped=0x0) returned 1 [0182.529] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbc10, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xbc10, lpOverlapped=0x0) returned 1 [0182.531] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.553] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.572] CloseHandle (hObject=0xf4) returned 1 [0182.573] CloseHandle (hObject=0xfc) returned 1 [0182.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V26-2dmac5vuf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v26-2dmac5vuf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5632362D32646D616335767566.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5632362d32646d616335767566.mp3")) returned 0 [0182.577] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5632362D32646D616335767566.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5632362d32646d616335767566.mp3")) returned 0x2020 [0182.577] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V26-2dmac5vuf.mp3", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14ab8300, ftCreationTime.dwHighDateTime=0x1d5ba67, ftLastAccessTime.dwLowDateTime=0xb25de370, ftLastAccessTime.dwHighDateTime=0x1d5bf64, ftLastWriteTime.dwLowDateTime=0xb25de370, ftLastWriteTime.dwHighDateTime=0x1d5bf64, nFileSizeHigh=0x0, nFileSizeLow=0xbc03, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="V26-2dmac5vuf.mp3", cAlternateFileName="V26-2D~1.MP3")) returned 0x324f58 [0182.577] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14ab8300, ftCreationTime.dwHighDateTime=0x1d5ba67, ftLastAccessTime.dwLowDateTime=0xb25de370, ftLastAccessTime.dwHighDateTime=0x1d5bf64, ftLastWriteTime.dwLowDateTime=0xb25de370, ftLastWriteTime.dwHighDateTime=0x1d5bf64, nFileSizeHigh=0x0, nFileSizeLow=0xbc03, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="V26-2dmac5vuf.mp3", cAlternateFileName="V26-2D~1.MP3")) returned 0 [0182.577] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0182.577] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V26-2dmac5vuf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v26-2dmac5vuf.mp3")) returned 1 [0182.579] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V26-2dmac5vuf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v26-2dmac5vuf.mp3")) returned 0xffffffff [0182.579] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8f0a50, ftCreationTime.dwHighDateTime=0x1d5b7a2, ftLastAccessTime.dwLowDateTime=0x362ad130, ftLastAccessTime.dwHighDateTime=0x1d5c222, ftLastWriteTime.dwLowDateTime=0x362ad130, ftLastWriteTime.dwHighDateTime=0x1d5c222, nFileSizeHigh=0x0, nFileSizeLow=0x7334, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="VpXWhNa3X.wav", cAlternateFileName="VPXWHN~1.WAV")) returned 1 [0182.580] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.580] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.580] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.580] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29508, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.580] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.580] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29508) returned 0x10ab [0182.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VpXWhNa3X.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vpxwhna3x.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0182.581] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\56705857684E613358.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\56705857684e613358.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.582] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7334 [0182.582] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0182.583] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0182.677] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x7334, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x7334, lpOverlapped=0x0) returned 1 [0182.678] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x7340, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x7340, lpOverlapped=0x0) returned 1 [0182.680] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.703] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.713] CloseHandle (hObject=0xfc) returned 1 [0182.713] CloseHandle (hObject=0xf4) returned 1 [0182.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VpXWhNa3X.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vpxwhna3x.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\56705857684E613358.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\56705857684e613358.wav")) returned 0 [0182.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\56705857684E613358.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\56705857684e613358.wav")) returned 0x2020 [0182.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VpXWhNa3X.wav", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8f0a50, ftCreationTime.dwHighDateTime=0x1d5b7a2, ftLastAccessTime.dwLowDateTime=0x362ad130, ftLastAccessTime.dwHighDateTime=0x1d5c222, ftLastWriteTime.dwLowDateTime=0x362ad130, ftLastWriteTime.dwHighDateTime=0x1d5c222, nFileSizeHigh=0x0, nFileSizeLow=0x7334, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="VpXWhNa3X.wav", cAlternateFileName="VPXWHN~1.WAV")) returned 0x324f58 [0182.714] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8f0a50, ftCreationTime.dwHighDateTime=0x1d5b7a2, ftLastAccessTime.dwLowDateTime=0x362ad130, ftLastAccessTime.dwHighDateTime=0x1d5c222, ftLastWriteTime.dwLowDateTime=0x362ad130, ftLastWriteTime.dwHighDateTime=0x1d5c222, nFileSizeHigh=0x0, nFileSizeLow=0x7334, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="VpXWhNa3X.wav", cAlternateFileName="VPXWHN~1.WAV")) returned 0 [0182.714] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0182.714] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VpXWhNa3X.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vpxwhna3x.wav")) returned 1 [0182.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VpXWhNa3X.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vpxwhna3x.wav")) returned 0xffffffff [0182.716] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcc050fd0, ftCreationTime.dwHighDateTime=0x1d5baad, ftLastAccessTime.dwLowDateTime=0x3e267ea0, ftLastAccessTime.dwHighDateTime=0x1d5ba5e, ftLastWriteTime.dwLowDateTime=0x3e267ea0, ftLastWriteTime.dwHighDateTime=0x1d5ba5e, nFileSizeHigh=0x0, nFileSizeLow=0xf46d, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="VQeg5z.odp", cAlternateFileName="")) returned 1 [0182.716] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.716] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.716] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29780, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.717] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.717] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29780) returned 0x10ab [0182.717] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0182.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee74, dwReserved1=0x18ee74, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0182.717] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee74, dwReserved1=0x18ee74, cFileName="..", cAlternateFileName="")) returned 1 [0182.717] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee74, dwReserved1=0x18ee74, cFileName="..", cAlternateFileName="")) returned 0 [0182.717] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0182.718] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x856707f0, ftCreationTime.dwHighDateTime=0x1d5c164, ftLastAccessTime.dwLowDateTime=0xe24b4f40, ftLastAccessTime.dwHighDateTime=0x1d5befc, ftLastWriteTime.dwLowDateTime=0xe24b4f40, ftLastWriteTime.dwHighDateTime=0x1d5befc, nFileSizeHigh=0x0, nFileSizeLow=0x5fc4, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="wPDq07-WWN5rYVarHsN8.mp4", cAlternateFileName="WPDQ07~1.MP4")) returned 1 [0182.718] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.718] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.718] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.718] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c298e0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.718] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.718] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c298e0) returned 0x10ab [0182.718] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x970dc190, ftCreationTime.dwHighDateTime=0x1d5bfb3, ftLastAccessTime.dwLowDateTime=0x2e275110, ftLastAccessTime.dwHighDateTime=0x1d5c1ce, ftLastWriteTime.dwLowDateTime=0x2e275110, ftLastWriteTime.dwHighDateTime=0x1d5c1ce, nFileSizeHigh=0x0, nFileSizeLow=0xc444, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="X1jei.mp3", cAlternateFileName="")) returned 1 [0182.718] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.718] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.718] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.718] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2998c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.719] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.719] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2998c) returned 0x10ab [0182.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X1jei.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x1jei.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\58316A6569.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\58316a6569.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0182.720] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc444 [0182.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0182.720] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0182.811] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc444, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc444, lpOverlapped=0x0) returned 1 [0182.812] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc450, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc450, lpOverlapped=0x0) returned 1 [0182.814] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.837] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.849] CloseHandle (hObject=0xf4) returned 1 [0182.849] CloseHandle (hObject=0xfc) returned 1 [0182.849] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X1jei.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x1jei.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\58316A6569.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\58316a6569.mp3")) returned 0 [0182.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\58316A6569.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\58316a6569.mp3")) returned 0x2020 [0182.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X1jei.mp3", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x970dc190, ftCreationTime.dwHighDateTime=0x1d5bfb3, ftLastAccessTime.dwLowDateTime=0x2e275110, ftLastAccessTime.dwHighDateTime=0x1d5c1ce, ftLastWriteTime.dwLowDateTime=0x2e275110, ftLastWriteTime.dwHighDateTime=0x1d5c1ce, nFileSizeHigh=0x0, nFileSizeLow=0xc444, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="X1jei.mp3", cAlternateFileName="")) returned 0x324f58 [0182.850] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x970dc190, ftCreationTime.dwHighDateTime=0x1d5bfb3, ftLastAccessTime.dwLowDateTime=0x2e275110, ftLastAccessTime.dwHighDateTime=0x1d5c1ce, ftLastWriteTime.dwLowDateTime=0x2e275110, ftLastWriteTime.dwHighDateTime=0x1d5c1ce, nFileSizeHigh=0x0, nFileSizeLow=0xc444, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="X1jei.mp3", cAlternateFileName="")) returned 0 [0182.850] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0182.850] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X1jei.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x1jei.mp3")) returned 1 [0182.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X1jei.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x1jei.mp3")) returned 0xffffffff [0182.851] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x91085980, ftCreationTime.dwHighDateTime=0x1d5b90b, ftLastAccessTime.dwLowDateTime=0x4e1ef6a0, ftLastAccessTime.dwHighDateTime=0x1d5c1ae, ftLastWriteTime.dwLowDateTime=0x4e1ef6a0, ftLastWriteTime.dwHighDateTime=0x1d5c1ae, nFileSizeHigh=0x0, nFileSizeLow=0x5e0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="xhRW8L.ppt", cAlternateFileName="")) returned 1 [0182.851] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.851] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.852] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.852] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29cb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.852] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.852] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29cb4) returned 0x10ab [0182.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xhRW8L.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xhrw8l.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0182.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\78685257384C.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\78685257384c.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.853] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e0f [0182.853] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0182.853] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0182.953] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5e0f, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x5e0f, lpOverlapped=0x0) returned 1 [0182.954] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5e10, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x5e10, lpOverlapped=0x0) returned 1 [0182.955] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.978] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.989] CloseHandle (hObject=0xfc) returned 1 [0182.989] CloseHandle (hObject=0xf4) returned 1 [0182.989] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xhRW8L.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xhrw8l.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\78685257384C.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\78685257384c.ppt")) returned 0 [0182.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\78685257384C.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\78685257384c.ppt")) returned 0x2020 [0182.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xhRW8L.ppt", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x91085980, ftCreationTime.dwHighDateTime=0x1d5b90b, ftLastAccessTime.dwLowDateTime=0x4e1ef6a0, ftLastAccessTime.dwHighDateTime=0x1d5c1ae, ftLastWriteTime.dwLowDateTime=0x4e1ef6a0, ftLastWriteTime.dwHighDateTime=0x1d5c1ae, nFileSizeHigh=0x0, nFileSizeLow=0x5e0f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="xhRW8L.ppt", cAlternateFileName="")) returned 0x324f58 [0182.990] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x91085980, ftCreationTime.dwHighDateTime=0x1d5b90b, ftLastAccessTime.dwLowDateTime=0x4e1ef6a0, ftLastAccessTime.dwHighDateTime=0x1d5c1ae, ftLastWriteTime.dwLowDateTime=0x4e1ef6a0, ftLastWriteTime.dwHighDateTime=0x1d5c1ae, nFileSizeHigh=0x0, nFileSizeLow=0x5e0f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="xhRW8L.ppt", cAlternateFileName="")) returned 0 [0182.990] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0182.990] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xhRW8L.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xhrw8l.ppt")) returned 1 [0182.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xhRW8L.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xhrw8l.ppt")) returned 0xffffffff [0182.991] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca1081a0, ftCreationTime.dwHighDateTime=0x1d5c296, ftLastAccessTime.dwLowDateTime=0xc60646e0, ftLastAccessTime.dwHighDateTime=0x1d5b7c8, ftLastWriteTime.dwLowDateTime=0xc60646e0, ftLastWriteTime.dwHighDateTime=0x1d5b7c8, nFileSizeHigh=0x0, nFileSizeLow=0x5384, dwReserved0=0x0, dwReserved1=0x0, cFileName="y12byH_.swf", cAlternateFileName="")) returned 1 [0182.991] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0182.991] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.992] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0182.992] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29eac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0182.992] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0182.992] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29eac) returned 0x10ab [0182.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y12byH_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\y12byh_.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7931326279485F.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7931326279485f.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0182.993] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5384 [0182.993] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0182.993] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0183.067] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5384, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x5384, lpOverlapped=0x0) returned 1 [0183.068] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5390, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x5390, lpOverlapped=0x0) returned 1 [0183.069] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.093] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.103] CloseHandle (hObject=0xf4) returned 1 [0183.103] CloseHandle (hObject=0xfc) returned 1 [0183.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y12byH_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\y12byh_.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7931326279485F.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7931326279485f.swf")) returned 0 [0183.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7931326279485F.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7931326279485f.swf")) returned 0x2020 [0183.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y12byH_.swf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca1081a0, ftCreationTime.dwHighDateTime=0x1d5c296, ftLastAccessTime.dwLowDateTime=0xc60646e0, ftLastAccessTime.dwHighDateTime=0x1d5b7c8, ftLastWriteTime.dwLowDateTime=0xc60646e0, ftLastWriteTime.dwHighDateTime=0x1d5b7c8, nFileSizeHigh=0x0, nFileSizeLow=0x5384, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="y12byH_.swf", cAlternateFileName="")) returned 0x324f58 [0183.104] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca1081a0, ftCreationTime.dwHighDateTime=0x1d5c296, ftLastAccessTime.dwLowDateTime=0xc60646e0, ftLastAccessTime.dwHighDateTime=0x1d5b7c8, ftLastWriteTime.dwLowDateTime=0xc60646e0, ftLastWriteTime.dwHighDateTime=0x1d5b7c8, nFileSizeHigh=0x0, nFileSizeLow=0x5384, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="y12byH_.swf", cAlternateFileName="")) returned 0 [0183.104] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0183.104] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y12byH_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\y12byh_.swf")) returned 1 [0183.105] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y12byH_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\y12byh_.swf")) returned 0xffffffff [0183.105] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a2de050, ftCreationTime.dwHighDateTime=0x1d5baeb, ftLastAccessTime.dwLowDateTime=0xa0821c10, ftLastAccessTime.dwHighDateTime=0x1d5c573, ftLastWriteTime.dwLowDateTime=0xa0821c10, ftLastWriteTime.dwHighDateTime=0x1d5c573, nFileSizeHigh=0x0, nFileSizeLow=0xe881, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="YOkFgpB06pfdlJZFOA.png", cAlternateFileName="YOKFGP~1.PNG")) returned 1 [0183.106] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.106] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.106] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.106] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d34, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.106] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.106] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d34) returned 0x10ab [0183.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YOkFgpB06pfdlJZFOA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yokfgpb06pfdljzfoa.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0183.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594F6B4667704230367066646C4A5A464F41.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\594f6b4667704230367066646c4a5a464f41.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0183.107] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe881 [0183.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0183.107] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0183.195] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe881, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xe881, lpOverlapped=0x0) returned 1 [0183.197] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe890, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xe890, lpOverlapped=0x0) returned 1 [0183.198] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.221] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.231] CloseHandle (hObject=0xfc) returned 1 [0183.231] CloseHandle (hObject=0xf4) returned 1 [0183.231] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YOkFgpB06pfdlJZFOA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yokfgpb06pfdljzfoa.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594F6B4667704230367066646C4A5A464F41.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\594f6b4667704230367066646c4a5a464f41.png")) returned 0 [0183.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594F6B4667704230367066646C4A5A464F41.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\594f6b4667704230367066646c4a5a464f41.png")) returned 0x2020 [0183.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YOkFgpB06pfdlJZFOA.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a2de050, ftCreationTime.dwHighDateTime=0x1d5baeb, ftLastAccessTime.dwLowDateTime=0xa0821c10, ftLastAccessTime.dwHighDateTime=0x1d5c573, ftLastWriteTime.dwLowDateTime=0xa0821c10, ftLastWriteTime.dwHighDateTime=0x1d5c573, nFileSizeHigh=0x0, nFileSizeLow=0xe881, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="YOkFgpB06pfdlJZFOA.png", cAlternateFileName="YOKFGP~1.PNG")) returned 0x324f58 [0183.232] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a2de050, ftCreationTime.dwHighDateTime=0x1d5baeb, ftLastAccessTime.dwLowDateTime=0xa0821c10, ftLastAccessTime.dwHighDateTime=0x1d5c573, ftLastWriteTime.dwLowDateTime=0xa0821c10, ftLastWriteTime.dwHighDateTime=0x1d5c573, nFileSizeHigh=0x0, nFileSizeLow=0xe881, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="YOkFgpB06pfdlJZFOA.png", cAlternateFileName="YOKFGP~1.PNG")) returned 0 [0183.233] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0183.233] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YOkFgpB06pfdlJZFOA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yokfgpb06pfdljzfoa.png")) returned 1 [0183.234] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YOkFgpB06pfdlJZFOA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yokfgpb06pfdljzfoa.png")) returned 0xffffffff [0183.234] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79963a40, ftCreationTime.dwHighDateTime=0x1d5b79b, ftLastAccessTime.dwLowDateTime=0xe710ee70, ftLastAccessTime.dwHighDateTime=0x1d5bc5b, ftLastWriteTime.dwLowDateTime=0xe710ee70, ftLastWriteTime.dwHighDateTime=0x1d5bc5b, nFileSizeHigh=0x0, nFileSizeLow=0x10393, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="z31VglSDi1b-O.jpg", cAlternateFileName="Z31VGL~1.JPG")) returned 1 [0183.234] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.234] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29284, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29284) returned 0x10ab [0183.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z31VglSDi1b-O.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z31vglsdi1b-o.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0183.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7A333156676C53446931622D4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7a333156676c53446931622d4f.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0183.235] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10393 [0183.236] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0183.236] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0183.337] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10393, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x10393, lpOverlapped=0x0) returned 1 [0183.339] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x103a0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x103a0, lpOverlapped=0x0) returned 1 [0183.341] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.364] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.376] CloseHandle (hObject=0xf4) returned 1 [0183.376] CloseHandle (hObject=0xfc) returned 1 [0183.377] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z31VglSDi1b-O.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z31vglsdi1b-o.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7A333156676C53446931622D4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7a333156676c53446931622d4f.jpg")) returned 0 [0183.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7A333156676C53446931622D4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7a333156676c53446931622d4f.jpg")) returned 0x2020 [0183.378] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z31VglSDi1b-O.jpg", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79963a40, ftCreationTime.dwHighDateTime=0x1d5b79b, ftLastAccessTime.dwLowDateTime=0xe710ee70, ftLastAccessTime.dwHighDateTime=0x1d5bc5b, ftLastWriteTime.dwLowDateTime=0xe710ee70, ftLastWriteTime.dwHighDateTime=0x1d5bc5b, nFileSizeHigh=0x0, nFileSizeLow=0x10393, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="z31VglSDi1b-O.jpg", cAlternateFileName="Z31VGL~1.JPG")) returned 0x324f58 [0183.378] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79963a40, ftCreationTime.dwHighDateTime=0x1d5b79b, ftLastAccessTime.dwLowDateTime=0xe710ee70, ftLastAccessTime.dwHighDateTime=0x1d5bc5b, ftLastWriteTime.dwLowDateTime=0xe710ee70, ftLastWriteTime.dwHighDateTime=0x1d5bc5b, nFileSizeHigh=0x0, nFileSizeLow=0x10393, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="z31VglSDi1b-O.jpg", cAlternateFileName="Z31VGL~1.JPG")) returned 0 [0183.378] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0183.378] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z31VglSDi1b-O.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z31vglsdi1b-o.jpg")) returned 1 [0183.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z31VglSDi1b-O.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z31vglsdi1b-o.jpg")) returned 0xffffffff [0183.380] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb39eb00, ftCreationTime.dwHighDateTime=0x1d5b9b2, ftLastAccessTime.dwLowDateTime=0x51283130, ftLastAccessTime.dwHighDateTime=0x1d5bb1a, ftLastWriteTime.dwLowDateTime=0x51283130, ftLastWriteTime.dwHighDateTime=0x1d5bb1a, nFileSizeHigh=0x0, nFileSizeLow=0x1f87, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="zJwP7H3ut57aQKwf.mp4", cAlternateFileName="ZJWP7H~1.MP4")) returned 1 [0183.380] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.380] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.380] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.381] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.381] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.381] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f10) returned 0x10ab [0183.381] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb39eb00, ftCreationTime.dwHighDateTime=0x1d5b9b2, ftLastAccessTime.dwLowDateTime=0x51283130, ftLastAccessTime.dwHighDateTime=0x1d5bb1a, ftLastWriteTime.dwLowDateTime=0x51283130, ftLastWriteTime.dwHighDateTime=0x1d5bb1a, nFileSizeHigh=0x0, nFileSizeLow=0x1f87, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="zJwP7H3ut57aQKwf.mp4", cAlternateFileName="ZJWP7H~1.MP4")) returned 0 [0183.381] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0183.381] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e66, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0183.381] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb39eb00, ftCreationTime.dwHighDateTime=0x1d5b9b2, ftLastAccessTime.dwLowDateTime=0x51283130, ftLastAccessTime.dwHighDateTime=0x1d5bb1a, ftLastWriteTime.dwLowDateTime=0x51283130, ftLastWriteTime.dwHighDateTime=0x1d5bb1a, nFileSizeHigh=0x0, nFileSizeLow=0x1f87, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="zJwP7H3ut57aQKwf.mp4", cAlternateFileName="øÇ1")) returned 0xffffffff [0183.382] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e66, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0183.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0183.382] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="..", cAlternateFileName="")) returned 1 [0183.382] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="..", cAlternateFileName="")) returned 0 [0183.382] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0183.382] FindNextFileA (in: hFindFile=0x31c7f8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e66, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0183.382] FindClose (in: hFindFile=0x31c7f8 | out: hFindFile=0x31c7f8) returned 1 [0183.383] FindNextFileA (in: hFindFile=0x31c7b8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0183.383] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e66, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0183.383] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e66, cFileName="..", cAlternateFileName="")) returned 1 [0183.383] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e66, cFileName="Adobe", cAlternateFileName="")) returned 1 [0183.383] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0183.384] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="..", cAlternateFileName="")) returned 1 [0183.384] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0183.385] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0183.385] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.385] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0183.385] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0183.436] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.436] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0183.437] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.437] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2807c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2807c) returned 0x10ab [0183.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\7264726D657373616765.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\7264726d657373616765.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0183.439] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa5ff [0183.439] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0183.439] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0183.518] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa5ff, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa5ff, lpOverlapped=0x0) returned 1 [0183.520] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa600, lpOverlapped=0x0) returned 1 [0183.522] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.543] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.554] CloseHandle (hObject=0x100) returned 1 [0183.554] CloseHandle (hObject=0x104) returned 1 [0183.554] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\7264726D657373616765.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\7264726d657373616765.zip")) returned 0 [0183.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\7264726D657373616765.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\7264726d657373616765.zip")) returned 0x2020 [0183.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 0x325018 [0183.555] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 0 [0183.555] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0183.555] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip")) returned 1 [0183.556] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip")) returned 0xffffffff [0183.556] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0183.557] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.557] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.557] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.557] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c280ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.557] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.557] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c280ec) returned 0x10ab [0183.557] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Search", cAlternateFileName="")) returned 1 [0183.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName=".", cAlternateFileName="")) returned 0x325018 [0183.559] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="..", cAlternateFileName="")) returned 1 [0183.559] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="..", cAlternateFileName="")) returned 0 [0183.559] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0183.559] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Search", cAlternateFileName="")) returned 0 [0183.559] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0183.559] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0183.559] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0183.559] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0183.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0183.560] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.560] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0183.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0183.560] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 1 [0183.560] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0183.561] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0183.562] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.562] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0183.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.562] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.562] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.562] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.562] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0183.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.563] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.563] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.563] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.563] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0183.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.564] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.564] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.564] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.564] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0183.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.564] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.564] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.564] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.565] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0183.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.565] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.565] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.565] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.565] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0183.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.565] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.565] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.565] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.565] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0183.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.565] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.566] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.566] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.566] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0183.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.566] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.566] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.566] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.566] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0183.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.566] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.566] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.566] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.566] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0183.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.567] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.567] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.567] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.567] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0183.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.567] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.567] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.567] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.567] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0183.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.567] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.567] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.567] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.567] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0183.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0183.568] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.568] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.568] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0183.568] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0183.568] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0183.568] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0183.568] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0183.568] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0183.568] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0183.568] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0183.568] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0183.568] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e66, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0183.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0183.568] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="..", cAlternateFileName="")) returned 1 [0183.568] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0183.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0183.568] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName="..", cAlternateFileName="")) returned 1 [0183.568] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName="Content", cAlternateFileName="")) returned 1 [0183.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0183.569] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.569] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0183.569] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.569] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.569] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.569] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2967c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.569] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.569] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2967c) returned 0x10ab [0183.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0183.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\30323438323342333946424541434344423543303634323641383136384539395F3644354341423136314131433635333632413931334432394245303944393142" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\30323438323342333946424541434344423543303634323641383136384539395f3644354341423136314131433635333632413931334432394245303944393142"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.570] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7 [0183.570] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0183.571] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0183.662] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d7, lpOverlapped=0x0) returned 1 [0183.663] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0183.663] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.685] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.696] CloseHandle (hObject=0x104) returned 1 [0183.696] CloseHandle (hObject=0x100) returned 1 [0183.696] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\30323438323342333946424541434344423543303634323641383136384539395F3644354341423136314131433635333632413931334432394245303944393142" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\30323438323342333946424541434344423543303634323641383136384539395f3644354341423136314131433635333632413931334432394245303944393142")) returned 0 [0183.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\30323438323342333946424541434344423543303634323641383136384539395F3644354341423136314131433635333632413931334432394245303944393142" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\30323438323342333946424541434344423543303634323641383136384539395f3644354341423136314131433635333632413931334432394245303944393142")) returned 0x2020 [0183.697] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 0x325018 [0183.697] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 0 [0183.697] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0183.697] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b")) returned 1 [0183.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b")) returned 0xffffffff [0183.699] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0183.699] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.699] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.699] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.699] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29acc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.699] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.700] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29acc) returned 0x10ab [0183.700] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.700] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\30463135383346464634324646463437364130393830314143423639323133465F4533463441384339363435344437443334343144324331424345383146383735" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\30463135383346464634324646463437364130393830314143423639323133465f4533463441384339363435344437443334343144324331424345383146383735"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0183.700] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x561 [0183.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0183.701] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0183.789] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x561, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x561, lpOverlapped=0x0) returned 1 [0183.791] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x570, lpOverlapped=0x0) returned 1 [0183.792] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.814] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.825] CloseHandle (hObject=0x100) returned 1 [0183.825] CloseHandle (hObject=0x104) returned 1 [0183.825] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\30463135383346464634324646463437364130393830314143423639323133465F4533463441384339363435344437443334343144324331424345383146383735" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\30463135383346464634324646463437364130393830314143423639323133465f4533463441384339363435344437443334343144324331424345383146383735")) returned 0 [0183.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\30463135383346464634324646463437364130393830314143423639323133465F4533463441384339363435344437443334343144324331424345383146383735" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\30463135383346464634324646463437364130393830314143423639323133465f4533463441384339363435344437443334343144324331424345383146383735")) returned 0x2020 [0183.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 0x325018 [0183.826] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 0 [0183.826] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0183.826] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875")) returned 1 [0183.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875")) returned 0xffffffff [0183.827] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0183.827] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.827] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.827] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.827] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a0fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.827] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.827] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a0fc) returned 0x10ab [0183.827] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0183.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\31424230394245454331353532353838333543313933413741413835414135425F4137423242353341463241313245324342304134314239364432314437393733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\31424230394245454331353532353838333543313933413741413835414135425f4137423242353341463241313245324342304134314239364432314437393733"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.835] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d8 [0183.835] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0183.835] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0183.935] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d8, lpOverlapped=0x0) returned 1 [0183.936] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0183.937] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.959] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.971] CloseHandle (hObject=0x104) returned 1 [0183.971] CloseHandle (hObject=0x100) returned 1 [0183.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\31424230394245454331353532353838333543313933413741413835414135425F4137423242353341463241313245324342304134314239364432314437393733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\31424230394245454331353532353838333543313933413741413835414135425f4137423242353341463241313245324342304134314239364432314437393733")) returned 0 [0183.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\31424230394245454331353532353838333543313933413741413835414135425F4137423242353341463241313245324342304134314239364432314437393733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\31424230394245454331353532353838333543313933413741413835414135425f4137423242353341463241313245324342304134314239364432314437393733")) returned 0x2020 [0183.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 0x325018 [0183.972] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 0 [0183.972] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0183.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973")) returned 1 [0183.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973")) returned 0xffffffff [0183.973] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0183.974] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0183.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0183.974] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2c0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0183.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0183.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2c0) returned 0x10ab [0183.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1daf2884ec4dfa96ba4a58d4dbc9c406"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3144414632383834454334444641393642413441353844344442433943343036" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3144414632383834454334444641393642413441353844344442433943343036"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0183.976] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1d [0183.976] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0183.977] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0184.049] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf1d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xf1d, lpOverlapped=0x0) returned 1 [0184.051] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf20, lpOverlapped=0x0) returned 1 [0184.052] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.074] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.085] CloseHandle (hObject=0x100) returned 1 [0184.085] CloseHandle (hObject=0x104) returned 1 [0184.085] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1daf2884ec4dfa96ba4a58d4dbc9c406"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3144414632383834454334444641393642413441353844344442433943343036" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3144414632383834454334444641393642413441353844344442433943343036")) returned 0 [0184.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3144414632383834454334444641393642413441353844344442433943343036" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3144414632383834454334444641393642413441353844344442433943343036")) returned 0x2020 [0184.086] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 0x325018 [0184.086] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 0 [0184.086] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0184.086] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1daf2884ec4dfa96ba4a58d4dbc9c406")) returned 1 [0184.087] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1daf2884ec4dfa96ba4a58d4dbc9c406")) returned 0xffffffff [0184.087] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0184.089] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0184.089] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.089] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0184.089] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a450, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0184.089] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.089] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a450) returned 0x10ab [0184.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0184.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3233423532334339453737343646373135443333433635323743313845423944" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3233423532334339453737343646373135443333433635323743313845423944"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0184.090] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145 [0184.091] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0184.091] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0184.178] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x145, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x145, lpOverlapped=0x0) returned 1 [0184.179] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x150, lpOverlapped=0x0) returned 1 [0184.180] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.206] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.218] CloseHandle (hObject=0x104) returned 1 [0184.218] CloseHandle (hObject=0x100) returned 1 [0184.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3233423532334339453737343646373135443333433635323743313845423944" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3233423532334339453737343646373135443333433635323743313845423944")) returned 0 [0184.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3233423532334339453737343646373135443333433635323743313845423944" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3233423532334339453737343646373135443333433635323743313845423944")) returned 0x2020 [0184.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 0x325018 [0184.219] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 0 [0184.219] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0184.219] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d")) returned 1 [0184.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d")) returned 0xffffffff [0184.220] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0184.221] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0184.221] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.221] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0184.221] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28374, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0184.221] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.221] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28374) returned 0x10ab [0184.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0184.223] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3331333042313837314131323635323041384334373836314546453345443444" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3331333042313837314131323635323041384334373836314546453345443444"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0184.224] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x209 [0184.224] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0184.224] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0184.316] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x209, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x209, lpOverlapped=0x0) returned 1 [0184.317] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x210, lpOverlapped=0x0) returned 1 [0184.318] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.341] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.352] CloseHandle (hObject=0x100) returned 1 [0184.352] CloseHandle (hObject=0x104) returned 1 [0184.352] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3331333042313837314131323635323041384334373836314546453345443444" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3331333042313837314131323635323041384334373836314546453345443444")) returned 0 [0184.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3331333042313837314131323635323041384334373836314546453345443444" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3331333042313837314131323635323041384334373836314546453345443444")) returned 0x2020 [0184.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 0x325018 [0184.353] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 0 [0184.353] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0184.353] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d")) returned 1 [0184.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d")) returned 0xffffffff [0184.354] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0184.355] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0184.355] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.355] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0184.355] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c298ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0184.355] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.355] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c298ec) returned 0x10ab [0184.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0184.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\33333838454343334637424334413932373143313045443836323145354136355F4635354335313230343739343742373046393444453544454336443638333844" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\33333838454343334637424334413932373143313045443836323145354136355f4635354335313230343739343742373046393444453544454336443638333844"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0184.356] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58b [0184.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0184.356] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0184.452] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x58b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x58b, lpOverlapped=0x0) returned 1 [0184.454] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x590, lpOverlapped=0x0) returned 1 [0184.455] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.477] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.488] CloseHandle (hObject=0x104) returned 1 [0184.488] CloseHandle (hObject=0x100) returned 1 [0184.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\33333838454343334637424334413932373143313045443836323145354136355F4635354335313230343739343742373046393444453544454336443638333844" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\33333838454343334637424334413932373143313045443836323145354136355f4635354335313230343739343742373046393444453544454336443638333844")) returned 0 [0184.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\33333838454343334637424334413932373143313045443836323145354136355F4635354335313230343739343742373046393444453544454336443638333844" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\33333838454343334637424334413932373143313045443836323145354136355f4635354335313230343739343742373046393444453544454336443638333844")) returned 0x2020 [0184.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 0x325018 [0184.490] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 0 [0184.490] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0184.490] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d")) returned 1 [0184.490] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d")) returned 0xffffffff [0184.491] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0184.491] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0184.491] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.491] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0184.491] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ebc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0184.491] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.491] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ebc) returned 0x10ab [0184.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0184.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34304534353046374345313334313941324343433241353434353033354130415F3036463032423146313341423442313142384643363639424445353635414631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34304534353046374345313334313941324343433241353434353033354130415f3036463032423146313341423442313142384643363639424445353635414631"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0184.492] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb68 [0184.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0184.493] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0184.605] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb68, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xb68, lpOverlapped=0x0) returned 1 [0184.740] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xb70, lpOverlapped=0x0) returned 1 [0184.744] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.767] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.780] CloseHandle (hObject=0x100) returned 1 [0184.780] CloseHandle (hObject=0x104) returned 1 [0184.783] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34304534353046374345313334313941324343433241353434353033354130415F3036463032423146313341423442313142384643363639424445353635414631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34304534353046374345313334313941324343433241353434353033354130415f3036463032423146313341423442313142384643363639424445353635414631")) returned 0 [0184.784] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34304534353046374345313334313941324343433241353434353033354130415F3036463032423146313341423442313142384643363639424445353635414631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34304534353046374345313334313941324343433241353434353033354130415f3036463032423146313341423442313142384643363639424445353635414631")) returned 0x2020 [0184.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 0x325018 [0184.784] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 0 [0184.784] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0184.784] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1")) returned 1 [0184.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1")) returned 0xffffffff [0184.785] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0184.788] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0184.789] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.792] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0184.792] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a110, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0184.792] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.792] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a110) returned 0x10ab [0184.792] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0184.793] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34433846383431464230324445433843313031303830323844423836413038445F3844414646464432443433424443374131373137463542363143333033333938" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34433846383431464230324445433843313031303830323844423836413038445f3844414646464432443433424443374131373137463542363143333033333938"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0184.794] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7 [0184.794] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0184.794] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0184.895] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d7, lpOverlapped=0x0) returned 1 [0184.896] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0184.897] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.921] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.931] CloseHandle (hObject=0x104) returned 1 [0184.932] CloseHandle (hObject=0x100) returned 1 [0184.932] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34433846383431464230324445433843313031303830323844423836413038445F3844414646464432443433424443374131373137463542363143333033333938" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34433846383431464230324445433843313031303830323844423836413038445f3844414646464432443433424443374131373137463542363143333033333938")) returned 0 [0184.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34433846383431464230324445433843313031303830323844423836413038445F3844414646464432443433424443374131373137463542363143333033333938" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34433846383431464230324445433843313031303830323844423836413038445f3844414646464432443433424443374131373137463542363143333033333938")) returned 0x2020 [0184.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 0x325018 [0184.933] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 0 [0184.933] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0184.933] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398")) returned 1 [0184.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398")) returned 0xffffffff [0184.934] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0184.934] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0184.934] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.935] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0184.935] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2c0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0184.935] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0184.935] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2c0) returned 0x10ab [0184.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0184.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34444433393732364434423535414333423431313942333541383933333233435F3436434343464239343041393346333941373334463639454643444437364539" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34444433393732364434423535414333423431313942333541383933333233435f3436434343464239343041393346333941373334463639454643444437364539"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0184.936] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x680 [0184.936] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0184.936] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0185.022] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x680, lpOverlapped=0x0) returned 1 [0185.024] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x690, lpOverlapped=0x0) returned 1 [0185.025] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.048] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.059] CloseHandle (hObject=0x100) returned 1 [0185.059] CloseHandle (hObject=0x104) returned 1 [0185.059] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34444433393732364434423535414333423431313942333541383933333233435F3436434343464239343041393346333941373334463639454643444437364539" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34444433393732364434423535414333423431313942333541383933333233435f3436434343464239343041393346333941373334463639454643444437364539")) returned 0 [0185.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\34444433393732364434423535414333423431313942333541383933333233435F3436434343464239343041393346333941373334463639454643444437364539" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\34444433393732364434423535414333423431313942333541383933333233435f3436434343464239343041393346333941373334463639454643444437364539")) returned 0x2020 [0185.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 0x325018 [0185.060] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 0 [0185.060] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0185.060] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9")) returned 1 [0185.061] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9")) returned 0xffffffff [0185.061] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0185.061] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0185.061] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.061] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0185.062] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28454, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0185.062] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.062] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28454) returned 0x10ab [0185.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0185.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35303830444337413635444236413539363045434438373430383846333332385F3239303846363832444643383141373933424432343043463239373131433737" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35303830444337413635444236413539363045434438373430383846333332385f3239303846363832444643383141373933424432343043463239373131433737"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.063] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d7 [0185.063] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0185.063] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0185.135] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2d7, lpOverlapped=0x0) returned 1 [0185.137] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2e0, lpOverlapped=0x0) returned 1 [0185.138] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.160] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.171] CloseHandle (hObject=0x104) returned 1 [0185.171] CloseHandle (hObject=0x100) returned 1 [0185.171] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35303830444337413635444236413539363045434438373430383846333332385F3239303846363832444643383141373933424432343043463239373131433737" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35303830444337413635444236413539363045434438373430383846333332385f3239303846363832444643383141373933424432343043463239373131433737")) returned 0 [0185.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35303830444337413635444236413539363045434438373430383846333332385F3239303846363832444643383141373933424432343043463239373131433737" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35303830444337413635444236413539363045434438373430383846333332385f3239303846363832444643383141373933424432343043463239373131433737")) returned 0x2020 [0185.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 0x325018 [0185.172] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 0 [0185.172] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0185.172] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77")) returned 1 [0185.173] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77")) returned 0xffffffff [0185.173] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0185.174] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0185.174] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.174] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0185.174] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a884, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0185.174] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.174] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a884) returned 0x10ab [0185.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35303830444337413635444236413539363045434438373430383846333332385F3643424132433036443539383544443935414535394146384643374336323230" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35303830444337413635444236413539363045434438373430383846333332385f3643424132433036443539383544443935414535394146384643374336323230"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0185.177] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d7 [0185.177] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0185.178] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0185.268] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2d7, lpOverlapped=0x0) returned 1 [0185.270] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2e0, lpOverlapped=0x0) returned 1 [0185.271] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.293] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.304] CloseHandle (hObject=0x100) returned 1 [0185.304] CloseHandle (hObject=0x104) returned 1 [0185.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35303830444337413635444236413539363045434438373430383846333332385F3643424132433036443539383544443935414535394146384643374336323230" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35303830444337413635444236413539363045434438373430383846333332385f3643424132433036443539383544443935414535394146384643374336323230")) returned 0 [0185.309] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35303830444337413635444236413539363045434438373430383846333332385F3643424132433036443539383544443935414535394146384643374336323230" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35303830444337413635444236413539363045434438373430383846333332385f3643424132433036443539383544443935414535394146384643374336323230")) returned 0x2020 [0185.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 0x325018 [0185.309] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 0 [0185.310] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0185.310] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220")) returned 1 [0185.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220")) returned 0xffffffff [0185.311] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0185.311] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0185.311] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.312] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0185.312] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28454, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0185.312] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.312] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28454) returned 0x10ab [0185.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0185.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35343537413843453442324137343939463832393941303133423645314337435F4345353046383933383831443433444330433831354534443830464146324234" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35343537413843453442324137343939463832393941303133423645314337435f4345353046383933383831443433444330433831354534443830464146324234"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.313] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7 [0185.313] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0185.314] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0185.422] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d7, lpOverlapped=0x0) returned 1 [0185.423] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0185.424] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.455] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.466] CloseHandle (hObject=0x104) returned 1 [0185.466] CloseHandle (hObject=0x100) returned 1 [0185.466] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35343537413843453442324137343939463832393941303133423645314337435F4345353046383933383831443433444330433831354534443830464146324234" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35343537413843453442324137343939463832393941303133423645314337435f4345353046383933383831443433444330433831354534443830464146324234")) returned 0 [0185.467] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\35343537413843453442324137343939463832393941303133423645314337435F4345353046383933383831443433444330433831354534443830464146324234" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\35343537413843453442324137343939463832393941303133423645314337435f4345353046383933383831443433444330433831354534443830464146324234")) returned 0x2020 [0185.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 0x325018 [0185.467] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 0 [0185.467] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0185.468] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4")) returned 1 [0185.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4")) returned 0xffffffff [0185.469] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0185.469] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0185.469] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.469] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0185.469] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29bd4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0185.469] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.469] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29bd4) returned 0x10ab [0185.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\696f3de637e6de85b458996d49d759ad"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3639364633444536333745364445383542343538393936443439443735394144" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3639364633444536333745364445383542343538393936443439443735394144"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0185.470] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32d [0185.471] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0185.471] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0185.559] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x32d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x32d, lpOverlapped=0x0) returned 1 [0185.560] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x330, lpOverlapped=0x0) returned 1 [0185.561] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.583] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.603] CloseHandle (hObject=0x100) returned 1 [0185.603] CloseHandle (hObject=0x104) returned 1 [0185.604] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\696f3de637e6de85b458996d49d759ad"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3639364633444536333745364445383542343538393936443439443735394144" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3639364633444536333745364445383542343538393936443439443735394144")) returned 0 [0185.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3639364633444536333745364445383542343538393936443439443735394144" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3639364633444536333745364445383542343538393936443439443735394144")) returned 0x2020 [0185.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 0x325018 [0185.605] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 0 [0185.605] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0185.605] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\696f3de637e6de85b458996d49d759ad")) returned 1 [0185.606] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\696f3de637e6de85b458996d49d759ad")) returned 0xffffffff [0185.606] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0185.606] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0185.606] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.606] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0185.607] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28454, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0185.607] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.607] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28454) returned 0x10ab [0185.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0185.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37303541373644453731454132434145424238463039303734343943453038365F3937353243354232443533454537413139463737363442353239363845433231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37303541373644453731454132434145424238463039303734343943453038365f3937353243354232443533454537413139463737363442353239363845433231"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.608] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x648 [0185.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0185.608] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0185.680] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x648, lpOverlapped=0x0) returned 1 [0185.688] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x650, lpOverlapped=0x0) returned 1 [0185.689] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.712] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.722] CloseHandle (hObject=0x104) returned 1 [0185.722] CloseHandle (hObject=0x100) returned 1 [0185.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37303541373644453731454132434145424238463039303734343943453038365F3937353243354232443533454537413139463737363442353239363845433231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37303541373644453731454132434145424238463039303734343943453038365f3937353243354232443533454537413139463737363442353239363845433231")) returned 0 [0185.723] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37303541373644453731454132434145424238463039303734343943453038365F3937353243354232443533454537413139463737363442353239363845433231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37303541373644453731454132434145424238463039303734343943453038365f3937353243354232443533454537413139463737363442353239363845433231")) returned 0x2020 [0185.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 0x325018 [0185.724] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 0 [0185.724] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0185.724] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21")) returned 1 [0185.725] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21")) returned 0xffffffff [0185.725] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0185.725] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0185.725] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.725] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0185.725] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a144, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0185.725] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.725] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a144) returned 0x10ab [0185.726] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.726] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3733393643343230413845314243314441393746314146304431304241443231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3733393643343230413845314243314441393746314146304431304241443231"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0185.727] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22a [0185.727] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0185.727] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0185.813] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x22a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x22a, lpOverlapped=0x0) returned 1 [0185.814] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x230, lpOverlapped=0x0) returned 1 [0185.815] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.838] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.849] CloseHandle (hObject=0x100) returned 1 [0185.849] CloseHandle (hObject=0x104) returned 1 [0185.849] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3733393643343230413845314243314441393746314146304431304241443231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3733393643343230413845314243314441393746314146304431304241443231")) returned 0 [0185.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3733393643343230413845314243314441393746314146304431304241443231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3733393643343230413845314243314441393746314146304431304241443231")) returned 0x2020 [0185.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 0x325018 [0185.850] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 0 [0185.850] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0185.850] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21")) returned 1 [0185.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21")) returned 0xffffffff [0185.852] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0185.853] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0185.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0185.853] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28454, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0185.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28454) returned 0x10ab [0185.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0185.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37343233463838433746323635463044454643303845413838433342444534355F4439373542424138303333313735433844313132303233443841374138414436" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37343233463838433746323635463044454643303845413838433342444534355f4439373542424138303333313735433844313132303233443841374138414436"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.859] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7 [0185.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0185.859] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0185.955] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d7, lpOverlapped=0x0) returned 1 [0185.956] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0185.957] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.980] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.990] CloseHandle (hObject=0x104) returned 1 [0185.990] CloseHandle (hObject=0x100) returned 1 [0185.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37343233463838433746323635463044454643303845413838433342444534355F4439373542424138303333313735433844313132303233443841374138414436" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37343233463838433746323635463044454643303845413838433342444534355f4439373542424138303333313735433844313132303233443841374138414436")) returned 0 [0185.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37343233463838433746323635463044454643303845413838433342444534355F4439373542424138303333313735433844313132303233443841374138414436" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37343233463838433746323635463044454643303845413838433342444534355f4439373542424138303333313735433844313132303233443841374138414436")) returned 0x2020 [0185.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 0x325018 [0185.992] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 0 [0185.992] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0185.992] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6")) returned 1 [0185.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6")) returned 0xffffffff [0185.993] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0185.994] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0185.994] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.994] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0185.994] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a694, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0185.994] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0185.994] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a694) returned 0x10ab [0185.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.995] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3742323233384141434345444333463146464538453745423546353735454339" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3742323233384141434345444333463146464538453745423546353735454339"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0185.996] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fa [0185.996] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0185.996] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0186.085] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1fa, lpOverlapped=0x0) returned 1 [0186.086] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x200, lpOverlapped=0x0) returned 1 [0186.087] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.109] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.120] CloseHandle (hObject=0x100) returned 1 [0186.120] CloseHandle (hObject=0x104) returned 1 [0186.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3742323233384141434345444333463146464538453745423546353735454339" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3742323233384141434345444333463146464538453745423546353735454339")) returned 0 [0186.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3742323233384141434345444333463146464538453745423546353735454339" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3742323233384141434345444333463146464538453745423546353735454339")) returned 0x2020 [0186.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 0x325018 [0186.122] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 0 [0186.122] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0186.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9")) returned 1 [0186.123] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9")) returned 0xffffffff [0186.123] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0186.123] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0186.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0186.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28404, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0186.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28404) returned 0x10ab [0186.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0186.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37423839343442413841443045464446304530314134334546363242454344305F4232444231434334423546324432413830324435364141454435323538303244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37423839343442413841443045464446304530314134334546363242454344305f4232444231434334423546324432413830324435364141454435323538303244"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.124] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67c [0186.125] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0186.125] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0186.203] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x67c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x67c, lpOverlapped=0x0) returned 1 [0186.205] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x680, lpOverlapped=0x0) returned 1 [0186.206] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.228] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.239] CloseHandle (hObject=0x104) returned 1 [0186.239] CloseHandle (hObject=0x100) returned 1 [0186.239] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37423839343442413841443045464446304530314134334546363242454344305F4232444231434334423546324432413830324435364141454435323538303244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37423839343442413841443045464446304530314134334546363242454344305f4232444231434334423546324432413830324435364141454435323538303244")) returned 0 [0186.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37423839343442413841443045464446304530314134334546363242454344305F4232444231434334423546324432413830324435364141454435323538303244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37423839343442413841443045464446304530314134334546363242454344305f4232444231434334423546324432413830324435364141454435323538303244")) returned 0x2020 [0186.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 0x325018 [0186.240] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 0 [0186.240] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0186.240] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d")) returned 1 [0186.242] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d")) returned 0xffffffff [0186.242] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0186.242] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0186.242] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.242] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0186.242] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29b44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0186.242] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.243] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29b44) returned 0x10ab [0186.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.244] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37443236364439453145363946413145454642393639394230303942333443385F3041394246444437354235393843323131304342463631304330373845364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37443236364439453145363946413145454642393639394230303942333443385f3041394246444437354235393843323131304342463631304330373845364536"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0186.244] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e3 [0186.244] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0186.245] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0186.331] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6e3, lpOverlapped=0x0) returned 1 [0186.332] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x6f0, lpOverlapped=0x0) returned 1 [0186.333] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.356] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.366] CloseHandle (hObject=0x100) returned 1 [0186.366] CloseHandle (hObject=0x104) returned 1 [0186.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37443236364439453145363946413145454642393639394230303942333443385F3041394246444437354235393843323131304342463631304330373845364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37443236364439453145363946413145454642393639394230303942333443385f3041394246444437354235393843323131304342463631304330373845364536")) returned 0 [0186.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37443236364439453145363946413145454642393639394230303942333443385F3041394246444437354235393843323131304342463631304330373845364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37443236364439453145363946413145454642393639394230303942333443385f3041394246444437354235393843323131304342463631304330373845364536")) returned 0x2020 [0186.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 0x325018 [0186.368] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 0 [0186.368] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0186.368] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6")) returned 1 [0186.369] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6")) returned 0xffffffff [0186.369] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0186.369] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0186.369] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.369] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0186.369] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ca4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0186.369] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.369] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ca4) returned 0x10ab [0186.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0186.370] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37443236364439453145363946413145454642393639394230303942333443385F3144354138373641393131334543303732323443343545354138373045334244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37443236364439453145363946413145454642393639394230303942333443385f3144354138373641393131334543303732323443343545354138373045334244"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.370] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e3 [0186.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0186.371] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0186.465] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6e3, lpOverlapped=0x0) returned 1 [0186.466] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x6f0, lpOverlapped=0x0) returned 1 [0186.467] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.490] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.500] CloseHandle (hObject=0x104) returned 1 [0186.500] CloseHandle (hObject=0x100) returned 1 [0186.500] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37443236364439453145363946413145454642393639394230303942333443385F3144354138373641393131334543303732323443343545354138373045334244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37443236364439453145363946413145454642393639394230303942333443385f3144354138373641393131334543303732323443343545354138373045334244")) returned 0 [0186.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37443236364439453145363946413145454642393639394230303942333443385F3144354138373641393131334543303732323443343545354138373045334244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\37443236364439453145363946413145454642393639394230303942333443385f3144354138373641393131334543303732323443343545354138373045334244")) returned 0x2020 [0186.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 0x325018 [0186.501] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 0 [0186.501] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0186.502] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd")) returned 1 [0186.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd")) returned 0xffffffff [0186.502] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0186.503] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0186.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.503] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0186.503] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28404, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0186.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.503] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28404) returned 0x10ab [0186.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.504] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3233344342354436343730354434444242344441383339373136333539414630" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3233344342354436343730354434444242344441383339373136333539414630"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0186.504] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0186.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0186.504] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0186.592] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0186.592] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0186.593] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.616] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.627] CloseHandle (hObject=0x100) returned 1 [0186.627] CloseHandle (hObject=0x104) returned 1 [0186.627] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3233344342354436343730354434444242344441383339373136333539414630" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3233344342354436343730354434444242344441383339373136333539414630")) returned 0 [0186.628] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3233344342354436343730354434444242344441383339373136333539414630" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3233344342354436343730354434444242344441383339373136333539414630")) returned 0x2020 [0186.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 0x325018 [0186.628] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 0 [0186.628] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0186.628] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0")) returned 1 [0186.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0")) returned 0xffffffff [0186.629] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0186.630] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0186.630] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.630] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0186.630] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a458, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0186.630] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.630] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a458) returned 0x10ab [0186.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0186.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3239343131304436393930454533393233323746384136303644353542433145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3239343131304436393930454533393233323746384136303644353542433145"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.631] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0186.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0186.632] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0186.718] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0186.719] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0186.720] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.742] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.752] CloseHandle (hObject=0x104) returned 1 [0186.752] CloseHandle (hObject=0x100) returned 1 [0186.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3239343131304436393930454533393233323746384136303644353542433145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3239343131304436393930454533393233323746384136303644353542433145")) returned 0 [0186.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3239343131304436393930454533393233323746384136303644353542433145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3239343131304436393930454533393233323746384136303644353542433145")) returned 0x2020 [0186.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 0x325018 [0186.754] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 0 [0186.754] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0186.754] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e")) returned 1 [0186.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e")) returned 0xffffffff [0186.755] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0186.755] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0186.755] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.755] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0186.755] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a7dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0186.756] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.756] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a7dc) returned 0x10ab [0186.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3530313637393039464346453043363631353346313930313433394342424131" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3530313637393039464346453043363631353346313930313433394342424131"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0186.757] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0186.757] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0186.757] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0186.828] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0186.829] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0186.829] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.852] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.862] CloseHandle (hObject=0x100) returned 1 [0186.862] CloseHandle (hObject=0x104) returned 1 [0186.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3530313637393039464346453043363631353346313930313433394342424131" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3530313637393039464346453043363631353346313930313433394342424131")) returned 0 [0186.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3530313637393039464346453043363631353346313930313433394342424131" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3530313637393039464346453043363631353346313930313433394342424131")) returned 0x2020 [0186.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 0x325018 [0186.864] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 0 [0186.864] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0186.864] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1")) returned 1 [0186.865] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1")) returned 0xffffffff [0186.865] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0186.865] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0186.865] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.865] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0186.865] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c282f4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0186.865] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0186.865] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c282f4) returned 0x10ab [0186.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0186.866] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3538314339303444423539323445343641364331413836333736313441343045" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3538314339303444423539323445343641364331413836333736313441343045"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.869] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0186.869] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0186.869] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0186.971] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0186.972] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0186.973] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.996] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.007] CloseHandle (hObject=0x104) returned 1 [0187.007] CloseHandle (hObject=0x100) returned 1 [0187.007] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3538314339303444423539323445343641364331413836333736313441343045" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3538314339303444423539323445343641364331413836333736313441343045")) returned 0 [0187.008] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3538314339303444423539323445343641364331413836333736313441343045" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3538314339303444423539323445343641364331413836333736313441343045")) returned 0x2020 [0187.008] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 0x325018 [0187.008] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 0 [0187.008] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0187.008] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e")) returned 1 [0187.009] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e")) returned 0xffffffff [0187.009] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0187.010] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0187.010] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.010] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0187.010] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2994c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0187.010] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.010] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2994c) returned 0x10ab [0187.010] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.010] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3545413635383434423945463536373041394330303243424438354231304134" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3545413635383434423945463536373041394330303243424438354231304134"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0187.011] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0187.011] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0187.011] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0187.100] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0187.101] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0187.102] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.124] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.135] CloseHandle (hObject=0x100) returned 1 [0187.135] CloseHandle (hObject=0x104) returned 1 [0187.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3545413635383434423945463536373041394330303243424438354231304134" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3545413635383434423945463536373041394330303243424438354231304134")) returned 0 [0187.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3545413635383434423945463536373041394330303243424438354231304134" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3545413635383434423945463536373041394330303243424438354231304134")) returned 0x2020 [0187.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 0x325018 [0187.136] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 0 [0187.136] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0187.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4")) returned 1 [0187.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4")) returned 0xffffffff [0187.137] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0187.138] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0187.138] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.138] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0187.138] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28404, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0187.138] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.138] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28404) returned 0x10ab [0187.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0187.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3734453934334637444142364431394533374534383534303537313535373738" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3734453934334637444142364431394533374534383534303537313535373738"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.140] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0187.140] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0187.140] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0187.226] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0187.227] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0187.228] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.250] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.261] CloseHandle (hObject=0x104) returned 1 [0187.261] CloseHandle (hObject=0x100) returned 1 [0187.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3734453934334637444142364431394533374534383534303537313535373738" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3734453934334637444142364431394533374534383534303537313535373738")) returned 0 [0187.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F3734453934334637444142364431394533374534383534303537313535373738" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f3734453934334637444142364431394533374534383534303537313535373738")) returned 0x2020 [0187.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 0x325018 [0187.262] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 0 [0187.262] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0187.263] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778")) returned 1 [0187.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778")) returned 0xffffffff [0187.263] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0187.264] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0187.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0187.264] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a0e0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0187.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a0e0) returned 0x10ab [0187.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.265] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4330383044413241453433314331413746334230433134374545423034334544" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4330383044413241453433314331413746334230433134374545423034334544"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0187.266] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0187.266] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0187.266] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0187.337] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0187.338] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0187.339] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.362] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.372] CloseHandle (hObject=0x100) returned 1 [0187.372] CloseHandle (hObject=0x104) returned 1 [0187.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4330383044413241453433314331413746334230433134374545423034334544" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4330383044413241453433314331413746334230433134374545423034334544")) returned 0 [0187.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4330383044413241453433314331413746334230433134374545423034334544" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4330383044413241453433314331413746334230433134374545423034334544")) returned 0x2020 [0187.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 0x325018 [0187.374] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 0 [0187.374] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0187.374] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed")) returned 1 [0187.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed")) returned 0xffffffff [0187.375] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0187.375] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0187.375] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.375] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0187.375] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a464, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0187.375] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.375] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a464) returned 0x10ab [0187.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0187.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4539303744374130343635373731344235423036443138424339323039373145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4539303744374130343635373731344235423036443138424339323039373145"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.377] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0187.377] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0187.377] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0187.471] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0187.471] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0187.472] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.495] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.505] CloseHandle (hObject=0x104) returned 1 [0187.506] CloseHandle (hObject=0x100) returned 1 [0187.506] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4539303744374130343635373731344235423036443138424339323039373145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4539303744374130343635373731344235423036443138424339323039373145")) returned 0 [0187.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4539303744374130343635373731344235423036443138424339323039373145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4539303744374130343635373731344235423036443138424339323039373145")) returned 0x2020 [0187.507] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 0x325018 [0187.507] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 0 [0187.507] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0187.507] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e")) returned 1 [0187.508] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e")) returned 0xffffffff [0187.508] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0187.508] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0187.508] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.508] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0187.508] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28404, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0187.508] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.508] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28404) returned 0x10ab [0187.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4632333138463741423333393830413133314132363534353443333943413330" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4632333138463741423333393830413133314132363534353443333943413330"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0187.509] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0187.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0187.510] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0187.599] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0187.600] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0187.601] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.623] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.634] CloseHandle (hObject=0x100) returned 1 [0187.634] CloseHandle (hObject=0x104) returned 1 [0187.641] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4632333138463741423333393830413133314132363534353443333943413330" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4632333138463741423333393830413133314132363534353443333943413330")) returned 0 [0187.643] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4632333138463741423333393830413133314132363534353443333943413330" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4632333138463741423333393830413133314132363534353443333943413330")) returned 0x2020 [0187.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 0x325018 [0187.643] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 0 [0187.643] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0187.643] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30")) returned 1 [0187.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30")) returned 0xffffffff [0187.645] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0187.646] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0187.646] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.646] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0187.646] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2978c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0187.646] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.646] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2978c) returned 0x10ab [0187.646] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0187.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4636453135373738444338453332363839354336303646424641303339324542" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4636453135373738444338453332363839354336303646424641303339324542"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.647] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0187.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0187.648] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0187.734] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1cf, lpOverlapped=0x0) returned 1 [0187.735] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0187.737] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.759] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.770] CloseHandle (hObject=0x104) returned 1 [0187.770] CloseHandle (hObject=0x100) returned 1 [0187.770] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4636453135373738444338453332363839354336303646424641303339324542" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4636453135373738444338453332363839354336303646424641303339324542")) returned 0 [0187.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38303539453941304433313438373745343046453933443843434642334336395F4636453135373738444338453332363839354336303646424641303339324542" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38303539453941304433313438373745343046453933443843434642334336395f4636453135373738444338453332363839354336303646424641303339324542")) returned 0x2020 [0187.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 0x325018 [0187.771] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 0 [0187.771] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0187.771] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb")) returned 1 [0187.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb")) returned 0xffffffff [0187.772] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0187.772] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0187.773] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.773] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0187.773] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29b10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0187.773] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.773] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29b10) returned 0x10ab [0187.773] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.773] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38323832393838323445413535343939343743313744444142463638373146355F3032303645464243353430333030433342463031363343444243334437443536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38323832393838323445413535343939343743313744444142463638373146355f3032303645464243353430333030433342463031363343444243334437443536"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0187.774] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56e [0187.774] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0187.774] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0187.849] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x56e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x56e, lpOverlapped=0x0) returned 1 [0187.851] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x570, lpOverlapped=0x0) returned 1 [0187.852] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.875] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.886] CloseHandle (hObject=0x100) returned 1 [0187.886] CloseHandle (hObject=0x104) returned 1 [0187.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38323832393838323445413535343939343743313744444142463638373146355F3032303645464243353430333030433342463031363343444243334437443536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38323832393838323445413535343939343743313744444142463638373146355f3032303645464243353430333030433342463031363343444243334437443536")) returned 0 [0187.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38323832393838323445413535343939343743313744444142463638373146355F3032303645464243353430333030433342463031363343444243334437443536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38323832393838323445413535343939343743313744444142463638373146355f3032303645464243353430333030433342463031363343444243334437443536")) returned 0x2020 [0187.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 0x325018 [0187.888] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 0 [0187.888] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0187.888] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56")) returned 1 [0187.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56")) returned 0xffffffff [0187.889] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0187.889] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0187.889] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.889] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0187.889] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28404, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0187.889] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0187.889] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28404) returned 0x10ab [0187.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0187.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38383238463339433743304345394131344232354337454233323131383142415F3344463934454237393730393636373446373739334135363241373738433546" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38383238463339433743304345394131344232354337454233323131383142415f3344463934454237393730393636373446373739334135363241373738433546"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.891] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e3 [0187.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0187.891] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0187.994] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6e3, lpOverlapped=0x0) returned 1 [0187.996] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x6f0, lpOverlapped=0x0) returned 1 [0187.997] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.019] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.030] CloseHandle (hObject=0x104) returned 1 [0188.030] CloseHandle (hObject=0x100) returned 1 [0188.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38383238463339433743304345394131344232354337454233323131383142415F3344463934454237393730393636373446373739334135363241373738433546" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38383238463339433743304345394131344232354337454233323131383142415f3344463934454237393730393636373446373739334135363241373738433546")) returned 0 [0188.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38383238463339433743304345394131344232354337454233323131383142415F3344463934454237393730393636373446373739334135363241373738433546" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38383238463339433743304345394131344232354337454233323131383142415f3344463934454237393730393636373446373739334135363241373738433546")) returned 0x2020 [0188.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 0x325018 [0188.031] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 0 [0188.031] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0188.031] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f")) returned 1 [0188.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f")) returned 0xffffffff [0188.032] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0188.033] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0188.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0188.033] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0188.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2a4) returned 0x10ab [0188.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38383238463339433743304345394131344232354337454233323131383142415F4336454637334534343832423235383842313235324431413634423939343136" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38383238463339433743304345394131344232354337454233323131383142415f4336454637334534343832423235383842313235324431413634423939343136"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0188.036] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e3 [0188.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0188.036] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0188.125] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6e3, lpOverlapped=0x0) returned 1 [0188.129] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x6f0, lpOverlapped=0x0) returned 1 [0188.130] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.153] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.164] CloseHandle (hObject=0x100) returned 1 [0188.164] CloseHandle (hObject=0x104) returned 1 [0188.164] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38383238463339433743304345394131344232354337454233323131383142415F4336454637334534343832423235383842313235324431413634423939343136" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38383238463339433743304345394131344232354337454233323131383142415f4336454637334534343832423235383842313235324431413634423939343136")) returned 0 [0188.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38383238463339433743304345394131344232354337454233323131383142415F4336454637334534343832423235383842313235324431413634423939343136" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38383238463339433743304345394131344232354337454233323131383142415f4336454637334534343832423235383842313235324431413634423939343136")) returned 0x2020 [0188.165] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 0x325018 [0188.165] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 0 [0188.165] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0188.165] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416")) returned 1 [0188.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416")) returned 0xffffffff [0188.166] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0188.167] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0188.167] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0188.167] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a628, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0188.167] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a628) returned 0x10ab [0188.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0188.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38453445353130463434413536423843384543464543333532393037433337335F3431313134303039384437314630323831333445394238413231323535433631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38453445353130463434413536423843384543464543333532393037433337335f3431313134303039384437314630323831333445394238413231323535433631"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.168] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59d [0188.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0188.168] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0188.258] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x59d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x59d, lpOverlapped=0x0) returned 1 [0188.259] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5a0, lpOverlapped=0x0) returned 1 [0188.261] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.283] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.294] CloseHandle (hObject=0x104) returned 1 [0188.294] CloseHandle (hObject=0x100) returned 1 [0188.294] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38453445353130463434413536423843384543464543333532393037433337335F3431313134303039384437314630323831333445394238413231323535433631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38453445353130463434413536423843384543464543333532393037433337335f3431313134303039384437314630323831333445394238413231323535433631")) returned 0 [0188.295] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\38453445353130463434413536423843384543464543333532393037433337335F3431313134303039384437314630323831333445394238413231323535433631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\38453445353130463434413536423843384543464543333532393037433337335f3431313134303039384437314630323831333445394238413231323535433631")) returned 0x2020 [0188.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 0x325018 [0188.295] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 0 [0188.295] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0188.295] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61")) returned 1 [0188.296] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61")) returned 0xffffffff [0188.296] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0188.297] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0188.297] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.297] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0188.297] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28374, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0188.297] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.297] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28374) returned 0x10ab [0188.297] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.297] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3934333038303539423537423331343245343535423338413645423932303135" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3934333038303539423537423331343245343535423338413645423932303135"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0188.298] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2da [0188.298] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0188.298] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0188.371] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd2da, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xd2da, lpOverlapped=0x0) returned 1 [0188.374] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd2e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xd2e0, lpOverlapped=0x0) returned 1 [0188.376] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.422] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.432] CloseHandle (hObject=0x100) returned 1 [0188.432] CloseHandle (hObject=0x104) returned 1 [0188.433] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3934333038303539423537423331343245343535423338413645423932303135" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3934333038303539423537423331343245343535423338413645423932303135")) returned 0 [0188.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3934333038303539423537423331343245343535423338413645423932303135" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3934333038303539423537423331343245343535423338413645423932303135")) returned 0x2020 [0188.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0x325018 [0188.434] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0 [0188.434] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0188.434] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015")) returned 1 [0188.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015")) returned 0xffffffff [0188.435] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0188.436] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0188.436] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.436] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0188.436] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28504, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0188.436] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.436] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28504) returned 0x10ab [0188.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0188.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39353543414236464636413234443538323044353042354241314346373943375F4144394537363135323937413341383333323041414345353830314130344639" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39353543414236464636413234443538323044353042354241314346373943375f4144394537363135323937413341383333323041414345353830314130344639"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.437] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e0 [0188.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0188.437] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0188.510] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5e0, lpOverlapped=0x0) returned 1 [0188.511] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5f0, lpOverlapped=0x0) returned 1 [0188.512] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.534] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.545] CloseHandle (hObject=0x104) returned 1 [0188.545] CloseHandle (hObject=0x100) returned 1 [0188.545] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39353543414236464636413234443538323044353042354241314346373943375F4144394537363135323937413341383333323041414345353830314130344639" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39353543414236464636413234443538323044353042354241314346373943375f4144394537363135323937413341383333323041414345353830314130344639")) returned 0 [0188.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39353543414236464636413234443538323044353042354241314346373943375F4144394537363135323937413341383333323041414345353830314130344639" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39353543414236464636413234443538323044353042354241314346373943375f4144394537363135323937413341383333323041414345353830314130344639")) returned 0x2020 [0188.546] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 0x325018 [0188.546] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 0 [0188.546] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0188.546] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9")) returned 1 [0188.547] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9")) returned 0xffffffff [0188.547] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0188.548] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0188.548] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.548] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0188.548] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f18, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0188.548] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.548] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f18) returned 0x10ab [0188.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39424332464643354439353931453142443335343532333045394237434333365F4346333039343335373146394245453936433438374232443946303433364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39424332464643354439353931453142443335343532333045394237434333365f4346333039343335373146394245453936433438374232443946303433364536"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0188.550] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ab [0188.550] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0188.550] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0188.637] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5ab, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5ab, lpOverlapped=0x0) returned 1 [0188.639] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5b0, lpOverlapped=0x0) returned 1 [0188.640] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.662] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.673] CloseHandle (hObject=0x100) returned 1 [0188.673] CloseHandle (hObject=0x104) returned 1 [0188.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39424332464643354439353931453142443335343532333045394237434333365F4346333039343335373146394245453936433438374232443946303433364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39424332464643354439353931453142443335343532333045394237434333365f4346333039343335373146394245453936433438374232443946303433364536")) returned 0 [0188.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39424332464643354439353931453142443335343532333045394237434333365F4346333039343335373146394245453936433438374232443946303433364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39424332464643354439353931453142443335343532333045394237434333365f4346333039343335373146394245453936433438374232443946303433364536")) returned 0x2020 [0188.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 0x325018 [0188.675] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 0 [0188.675] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0188.675] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6")) returned 1 [0188.676] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6")) returned 0xffffffff [0188.676] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0188.677] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0188.677] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.677] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0188.677] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a508, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0188.677] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.677] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a508) returned 0x10ab [0188.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0188.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39433838384245414243434243324139374230443644393231344333424133375F3132313344433646373145344333423035453742434545424332303341333145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39433838384245414243434243324139374230443644393231344333424133375f3132313344433646373145344333423035453742434545424332303341333145"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.678] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x652 [0188.679] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0188.679] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0188.766] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x652, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x652, lpOverlapped=0x0) returned 1 [0188.768] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x660, lpOverlapped=0x0) returned 1 [0188.769] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.791] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.802] CloseHandle (hObject=0x104) returned 1 [0188.802] CloseHandle (hObject=0x100) returned 1 [0188.802] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39433838384245414243434243324139374230443644393231344333424133375F3132313344433646373145344333423035453742434545424332303341333145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39433838384245414243434243324139374230443644393231344333424133375f3132313344433646373145344333423035453742434545424332303341333145")) returned 0 [0188.803] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39433838384245414243434243324139374230443644393231344333424133375F3132313344433646373145344333423035453742434545424332303341333145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39433838384245414243434243324139374230443644393231344333424133375f3132313344433646373145344333423035453742434545424332303341333145")) returned 0x2020 [0188.803] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 0x325018 [0188.803] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 0 [0188.803] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0188.803] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e")) returned 1 [0188.804] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e")) returned 0xffffffff [0188.804] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0188.805] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0188.805] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.805] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0188.805] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a7bc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0188.805] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.805] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a7bc) returned 0x10ab [0188.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39433838384245414243434243324139374230443644393231344333424133375F4542433735373238433631313941373745344441383535394444313046303631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39433838384245414243434243324139374230443644393231344333424133375f4542433735373238433631313941373745344441383535394444313046303631"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0188.806] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x652 [0188.806] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0188.806] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0188.879] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x652, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x652, lpOverlapped=0x0) returned 1 [0188.881] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x660, lpOverlapped=0x0) returned 1 [0188.882] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.904] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.916] CloseHandle (hObject=0x100) returned 1 [0188.917] CloseHandle (hObject=0x104) returned 1 [0188.917] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39433838384245414243434243324139374230443644393231344333424133375F4542433735373238433631313941373745344441383535394444313046303631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39433838384245414243434243324139374230443644393231344333424133375f4542433735373238433631313941373745344441383535394444313046303631")) returned 0 [0188.918] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\39433838384245414243434243324139374230443644393231344333424133375F4542433735373238433631313941373745344441383535394444313046303631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\39433838384245414243434243324139374230443644393231344333424133375f4542433735373238433631313941373745344441383535394444313046303631")) returned 0x2020 [0188.919] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 0x325018 [0188.919] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 0 [0188.919] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0188.919] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061")) returned 1 [0188.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061")) returned 0xffffffff [0188.920] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0188.920] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0188.920] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.920] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0188.920] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a8bc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0188.920] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0188.920] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a8bc) returned 0x10ab [0188.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0188.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\41394534463737363635373334354235323031324345384532373944333134435F3138334135424530423233334343314435313339353546414245434639343530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\41394534463737363635373334354235323031324345384532373944333134435f3138334135424530423233334343314435313339353546414245434639343530"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.933] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7 [0188.934] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0188.934] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0189.022] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d7, lpOverlapped=0x0) returned 1 [0189.023] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0189.024] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.047] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.058] CloseHandle (hObject=0x104) returned 1 [0189.058] CloseHandle (hObject=0x100) returned 1 [0189.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\41394534463737363635373334354235323031324345384532373944333134435F3138334135424530423233334343314435313339353546414245434639343530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\41394534463737363635373334354235323031324345384532373944333134435f3138334135424530423233334343314435313339353546414245434639343530")) returned 0 [0189.059] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\41394534463737363635373334354235323031324345384532373944333134435F3138334135424530423233334343314435313339353546414245434639343530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\41394534463737363635373334354235323031324345384532373944333134435f3138334135424530423233334343314435313339353546414245434639343530")) returned 0x2020 [0189.059] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 0x325018 [0189.059] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 0 [0189.059] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0189.059] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450")) returned 1 [0189.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450")) returned 0xffffffff [0189.060] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0189.061] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0189.061] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.061] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0189.061] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c282f4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0189.061] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.061] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c282f4) returned 0x10ab [0189.061] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0189.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\41434632343446314131304434444245443044383845424130433433413942355F4241314142364332424446444635373739394538313136453430303244303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\41434632343446314131304434444245443044383845424130433433413942355f4241314142364332424446444635373739394538313136453430303244303031"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0189.062] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ee [0189.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0189.062] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0189.150] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5ee, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5ee, lpOverlapped=0x0) returned 1 [0189.151] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5f0, lpOverlapped=0x0) returned 1 [0189.152] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.174] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.185] CloseHandle (hObject=0x100) returned 1 [0189.185] CloseHandle (hObject=0x104) returned 1 [0189.185] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\41434632343446314131304434444245443044383845424130433433413942355F4241314142364332424446444635373739394538313136453430303244303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\41434632343446314131304434444245443044383845424130433433413942355f4241314142364332424446444635373739394538313136453430303244303031")) returned 0 [0189.186] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\41434632343446314131304434444245443044383845424130433433413942355F4241314142364332424446444635373739394538313136453430303244303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\41434632343446314131304434444245443044383845424130433433413942355f4241314142364332424446444635373739394538313136453430303244303031")) returned 0x2020 [0189.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 0x325018 [0189.186] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 0 [0189.186] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0189.187] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001")) returned 1 [0189.187] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001")) returned 0xffffffff [0189.187] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0189.188] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0189.188] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.188] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0189.188] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29de4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0189.188] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.188] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29de4) returned 0x10ab [0189.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0189.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42334242394331424132443139453039304145333035423236383339303341305F3646304138344345324241393942443139443432433932363130323735383532" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42334242394331424132443139453039304145333035423236383339303341305f3646304138344345324241393942443139443432433932363130323735383532"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0189.190] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x652 [0189.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0189.191] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0189.277] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x652, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x652, lpOverlapped=0x0) returned 1 [0189.279] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x660, lpOverlapped=0x0) returned 1 [0189.280] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.302] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.313] CloseHandle (hObject=0x104) returned 1 [0189.313] CloseHandle (hObject=0x100) returned 1 [0189.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42334242394331424132443139453039304145333035423236383339303341305F3646304138344345324241393942443139443432433932363130323735383532" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42334242394331424132443139453039304145333035423236383339303341305f3646304138344345324241393942443139443432433932363130323735383532")) returned 0 [0189.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42334242394331424132443139453039304145333035423236383339303341305F3646304138344345324241393942443139443432433932363130323735383532" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42334242394331424132443139453039304145333035423236383339303341305f3646304138344345324241393942443139443432433932363130323735383532")) returned 0x2020 [0189.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 0x325018 [0189.315] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 0 [0189.315] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0189.315] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852")) returned 1 [0189.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852")) returned 0xffffffff [0189.316] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0189.317] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0189.317] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.317] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0189.317] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28464, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0189.317] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.317] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28464) returned 0x10ab [0189.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0189.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42334242394331424132443139453039304145333035423236383339303341305F4238394136334143363837374244314544383132343338434538324333454238" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42334242394331424132443139453039304145333035423236383339303341305f4238394136334143363837374244314544383132343338434538324333454238"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0189.318] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x652 [0189.318] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0189.319] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0189.419] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x652, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x652, lpOverlapped=0x0) returned 1 [0189.420] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x660, lpOverlapped=0x0) returned 1 [0189.421] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.444] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.455] CloseHandle (hObject=0x100) returned 1 [0189.455] CloseHandle (hObject=0x104) returned 1 [0189.455] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42334242394331424132443139453039304145333035423236383339303341305F4238394136334143363837374244314544383132343338434538324333454238" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42334242394331424132443139453039304145333035423236383339303341305f4238394136334143363837374244314544383132343338434538324333454238")) returned 0 [0189.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42334242394331424132443139453039304145333035423236383339303341305F4238394136334143363837374244314544383132343338434538324333454238" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42334242394331424132443139453039304145333035423236383339303341305f4238394136334143363837374244314544383132343338434538324333454238")) returned 0x2020 [0189.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 0x325018 [0189.456] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 0 [0189.456] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0189.456] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8")) returned 1 [0189.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8")) returned 0xffffffff [0189.458] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0189.458] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0189.458] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.458] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0189.458] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a508, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0189.458] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.458] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a508) returned 0x10ab [0189.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0189.459] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42433537304543304445353833333541464146393246444338453341413333305F3643453645353738423543383438354234424533433444353845313246313530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42433537304543304445353833333541464146393246444338453341413333305f3643453645353738423543383438354234424533433444353845313246313530"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0189.459] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ed [0189.459] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0189.460] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0189.554] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5ed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5ed, lpOverlapped=0x0) returned 1 [0189.556] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5f0, lpOverlapped=0x0) returned 1 [0189.556] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.607] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.619] CloseHandle (hObject=0x104) returned 1 [0189.619] CloseHandle (hObject=0x100) returned 1 [0189.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42433537304543304445353833333541464146393246444338453341413333305F3643453645353738423543383438354234424533433444353845313246313530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42433537304543304445353833333541464146393246444338453341413333305f3643453645353738423543383438354234424533433444353845313246313530")) returned 0 [0189.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42433537304543304445353833333541464146393246444338453341413333305F3643453645353738423543383438354234424533433444353845313246313530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42433537304543304445353833333541464146393246444338453341413333305f3643453645353738423543383438354234424533433444353845313246313530")) returned 0x2020 [0189.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 0x325018 [0189.620] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 0 [0189.621] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0189.621] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150")) returned 1 [0189.621] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150")) returned 0xffffffff [0189.622] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0189.622] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0189.622] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.622] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0189.622] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a88c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0189.622] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.622] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a88c) returned 0x10ab [0189.622] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0189.623] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42433537304543304445353833333541464146393246444338453341413333305F4634443434394341394530454143434645313539343646384643443334394643" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42433537304543304445353833333541464146393246444338453341413333305f4634443434394341394530454143434645313539343646384643443334394643"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0189.623] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ed [0189.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0189.624] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0189.695] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5ed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5ed, lpOverlapped=0x0) returned 1 [0189.697] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5f0, lpOverlapped=0x0) returned 1 [0189.697] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.720] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.731] CloseHandle (hObject=0x100) returned 1 [0189.731] CloseHandle (hObject=0x104) returned 1 [0189.731] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42433537304543304445353833333541464146393246444338453341413333305F4634443434394341394530454143434645313539343646384643443334394643" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42433537304543304445353833333541464146393246444338453341413333305f4634443434394341394530454143434645313539343646384643443334394643")) returned 0 [0189.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42433537304543304445353833333541464146393246444338453341413333305F4634443434394341394530454143434645313539343646384643443334394643" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\42433537304543304445353833333541464146393246444338453341413333305f4634443434394341394530454143434645313539343646384643443334394643")) returned 0x2020 [0189.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 0x325018 [0189.732] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 0 [0189.732] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0189.732] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc")) returned 1 [0189.733] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc")) returned 0xffffffff [0189.733] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0189.734] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0189.734] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.734] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0189.734] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c282f4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0189.734] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.734] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c282f4) returned 0x10ab [0189.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0189.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F3432383230434446454134314443383441414238394136423633353631383733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f3432383230434446454134314443383441414238394136423633353631383733"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0189.735] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e3 [0189.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0189.736] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0189.838] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6e3, lpOverlapped=0x0) returned 1 [0189.847] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x6f0, lpOverlapped=0x0) returned 1 [0189.849] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.872] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.883] CloseHandle (hObject=0x104) returned 1 [0189.883] CloseHandle (hObject=0x100) returned 1 [0189.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F3432383230434446454134314443383441414238394136423633353631383733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f3432383230434446454134314443383441414238394136423633353631383733")) returned 0 [0189.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F3432383230434446454134314443383441414238394136423633353631383733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f3432383230434446454134314443383441414238394136423633353631383733")) returned 0x2020 [0189.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 0x325018 [0189.885] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 0 [0189.885] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0189.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873")) returned 1 [0189.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873")) returned 0xffffffff [0189.886] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0189.887] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0189.887] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.887] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0189.887] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2999c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0189.887] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0189.887] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2999c) returned 0x10ab [0189.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0189.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F3630343346433630344133393545313438354146374143313644313642374345" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f3630343346433630344133393545313438354146374143313644313642374345"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0189.889] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e3 [0189.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0189.889] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0190.000] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6e3, lpOverlapped=0x0) returned 1 [0190.002] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x6f0, lpOverlapped=0x0) returned 1 [0190.003] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.026] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.037] CloseHandle (hObject=0x100) returned 1 [0190.038] CloseHandle (hObject=0x104) returned 1 [0190.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F3630343346433630344133393545313438354146374143313644313642374345" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f3630343346433630344133393545313438354146374143313644313642374345")) returned 0 [0190.039] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F3630343346433630344133393545313438354146374143313644313642374345" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f3630343346433630344133393545313438354146374143313644313642374345")) returned 0x2020 [0190.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 0x325018 [0190.039] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 0 [0190.039] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0190.039] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce")) returned 1 [0190.040] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce")) returned 0xffffffff [0190.040] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0190.040] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0190.040] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.040] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0190.040] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28454, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0190.041] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.041] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28454) returned 0x10ab [0190.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0190.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F4439423946333745434535393542304237423641413132343531443339324346" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f4439423946333745434535393542304237423641413132343531443339324346"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0190.042] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e3 [0190.042] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0190.042] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0190.116] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6e3, lpOverlapped=0x0) returned 1 [0190.118] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x6f0, lpOverlapped=0x0) returned 1 [0190.119] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.141] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.152] CloseHandle (hObject=0x104) returned 1 [0190.152] CloseHandle (hObject=0x100) returned 1 [0190.152] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F4439423946333745434535393542304237423641413132343531443339324346" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f4439423946333745434535393542304237423641413132343531443339324346")) returned 0 [0190.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\43343645374230463934323636334131454443384439443644373836393137335F4439423946333745434535393542304237423641413132343531443339324346" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\43343645374230463934323636334131454443384439443644373836393137335f4439423946333745434535393542304237423641413132343531443339324346")) returned 0x2020 [0190.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 0x325018 [0190.153] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 0 [0190.153] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0190.153] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf")) returned 1 [0190.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf")) returned 0xffffffff [0190.154] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0190.154] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0190.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0190.155] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a070, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0190.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a070) returned 0x10ab [0190.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0190.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44343744424432463945333336354642424530303844373146423036373136465F3444443130353342434337323644413431313135464646344337443645394343" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44343744424432463945333336354642424530303844373146423036373136465f3444443130353342434337323644413431313135464646344337443645394343"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0190.156] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ae [0190.156] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0190.157] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0190.245] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5ae, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5ae, lpOverlapped=0x0) returned 1 [0190.246] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5b0, lpOverlapped=0x0) returned 1 [0190.247] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.270] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.282] CloseHandle (hObject=0x100) returned 1 [0190.282] CloseHandle (hObject=0x104) returned 1 [0190.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44343744424432463945333336354642424530303844373146423036373136465F3444443130353342434337323644413431313135464646344337443645394343" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44343744424432463945333336354642424530303844373146423036373136465f3444443130353342434337323644413431313135464646344337443645394343")) returned 0 [0190.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44343744424432463945333336354642424530303844373146423036373136465F3444443130353342434337323644413431313135464646344337443645394343" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44343744424432463945333336354642424530303844373146423036373136465f3444443130353342434337323644413431313135464646344337443645394343")) returned 0x2020 [0190.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 0x325018 [0190.283] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 0 [0190.283] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0190.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc")) returned 1 [0190.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc")) returned 0xffffffff [0190.284] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0190.284] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0190.284] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.284] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0190.285] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28404, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0190.285] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.285] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28404) returned 0x10ab [0190.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0190.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44343744424432463945333336354642424530303844373146423036373136465F4433333139324435384141394341324239303937453834384539464538364445" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44343744424432463945333336354642424530303844373146423036373136465f4433333139324435384141394341324239303937453834384539464538364445"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0190.286] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ae [0190.286] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0190.286] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0190.375] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5ae, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5ae, lpOverlapped=0x0) returned 1 [0190.424] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5b0, lpOverlapped=0x0) returned 1 [0190.425] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.448] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.459] CloseHandle (hObject=0x104) returned 1 [0190.459] CloseHandle (hObject=0x100) returned 1 [0190.459] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44343744424432463945333336354642424530303844373146423036373136465F4433333139324435384141394341324239303937453834384539464538364445" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44343744424432463945333336354642424530303844373146423036373136465f4433333139324435384141394341324239303937453834384539464538364445")) returned 0 [0190.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44343744424432463945333336354642424530303844373146423036373136465F4433333139324435384141394341324239303937453834384539464538364445" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44343744424432463945333336354642424530303844373146423036373136465f4433333139324435384141394341324239303937453834384539464538364445")) returned 0x2020 [0190.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 0x325018 [0190.460] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 0 [0190.460] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0190.460] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de")) returned 1 [0190.461] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de")) returned 0xffffffff [0190.461] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0190.462] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0190.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0190.462] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a804, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0190.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a804) returned 0x10ab [0190.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0190.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44353243353644384632344245433936363034333732414642414632363445315F4537364132423632374444303139454235314439333335463234423134433243" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44353243353644384632344245433936363034333732414642414632363445315f4537364132423632374444303139454235314439333335463234423134433243"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0190.463] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x663 [0190.463] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0190.463] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0190.561] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x663, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x663, lpOverlapped=0x0) returned 1 [0190.565] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x670, lpOverlapped=0x0) returned 1 [0190.566] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.588] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.600] CloseHandle (hObject=0x100) returned 1 [0190.600] CloseHandle (hObject=0x104) returned 1 [0190.600] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44353243353644384632344245433936363034333732414642414632363445315F4537364132423632374444303139454235314439333335463234423134433243" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44353243353644384632344245433936363034333732414642414632363445315f4537364132423632374444303139454235314439333335463234423134433243")) returned 0 [0190.601] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\44353243353644384632344245433936363034333732414642414632363445315F4537364132423632374444303139454235314439333335463234423134433243" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\44353243353644384632344245433936363034333732414642414632363445315f4537364132423632374444303139454235314439333335463234423134433243")) returned 0x2020 [0190.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 0x325018 [0190.601] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 0 [0190.601] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0190.601] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c")) returned 1 [0190.602] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c")) returned 0xffffffff [0190.602] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0190.602] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0190.602] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.602] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0190.603] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa78, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0190.603] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.603] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa78) returned 0x10ab [0190.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0190.604] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\45413631383039374533393334303941464133313646304638374532433230325F3832374331423833373635324230343843344338343233374430383338353835" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\45413631383039374533393334303941464133313646304638374532433230325f3832374331423833373635324230343843344338343233374430383338353835"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0190.605] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x64b [0190.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0190.605] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0190.678] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x64b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x64b, lpOverlapped=0x0) returned 1 [0190.679] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x650, lpOverlapped=0x0) returned 1 [0190.680] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.703] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.713] CloseHandle (hObject=0x104) returned 1 [0190.713] CloseHandle (hObject=0x100) returned 1 [0190.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\45413631383039374533393334303941464133313646304638374532433230325F3832374331423833373635324230343843344338343233374430383338353835" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\45413631383039374533393334303941464133313646304638374532433230325f3832374331423833373635324230343843344338343233374430383338353835")) returned 0 [0190.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\45413631383039374533393334303941464133313646304638374532433230325F3832374331423833373635324230343843344338343233374430383338353835" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\45413631383039374533393334303941464133313646304638374532433230325f3832374331423833373635324230343843344338343233374430383338353835")) returned 0x2020 [0190.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 0x325018 [0190.714] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 0 [0190.714] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0190.714] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585")) returned 1 [0190.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585")) returned 0xffffffff [0190.715] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0190.716] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0190.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.716] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0190.716] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2999c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0190.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.716] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2999c) returned 0x10ab [0190.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0190.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\46323933414541443545383446414346423638364334413632303731383932385F4338343234413042323441373239333942313337323044304330303043394331" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\46323933414541443545383446414346423638364334413632303731383932385f4338343234413042323441373239333942313337323044304330303043394331"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0190.717] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x64c [0190.717] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0190.717] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0190.816] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x64c, lpOverlapped=0x0) returned 1 [0190.818] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x650, lpOverlapped=0x0) returned 1 [0190.819] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.841] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.852] CloseHandle (hObject=0x100) returned 1 [0190.852] CloseHandle (hObject=0x104) returned 1 [0190.852] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\46323933414541443545383446414346423638364334413632303731383932385F4338343234413042323441373239333942313337323044304330303043394331" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\46323933414541443545383446414346423638364334413632303731383932385f4338343234413042323441373239333942313337323044304330303043394331")) returned 0 [0190.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\46323933414541443545383446414346423638364334413632303731383932385F4338343234413042323441373239333942313337323044304330303043394331" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\46323933414541443545383446414346423638364334413632303731383932385f4338343234413042323441373239333942313337323044304330303043394331")) returned 0x2020 [0190.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 0x325018 [0190.853] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 0 [0190.853] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0190.853] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1")) returned 1 [0190.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1")) returned 0xffffffff [0190.855] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0190.855] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0190.855] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.855] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0190.855] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29efc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0190.855] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.855] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29efc) returned 0x10ab [0190.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0190.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4639304631383235374342423444383432313641433145314633424232433736" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4639304631383235374342423444383432313641433145314633424232433736"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0190.856] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x226 [0190.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0190.857] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0190.946] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x226, lpOverlapped=0x0) returned 1 [0190.946] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x230, lpOverlapped=0x0) returned 1 [0190.947] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.970] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.981] CloseHandle (hObject=0x104) returned 1 [0190.981] CloseHandle (hObject=0x100) returned 1 [0190.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4639304631383235374342423444383432313641433145314633424232433736" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4639304631383235374342423444383432313641433145314633424232433736")) returned 0 [0190.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4639304631383235374342423444383432313641433145314633424232433736" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4639304631383235374342423444383432313641433145314633424232433736")) returned 0x2020 [0190.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0x325018 [0190.982] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0190.982] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0190.982] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76")) returned 1 [0190.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76")) returned 0xffffffff [0190.993] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0190.993] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0190.993] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="MetaData", cAlternateFileName="")) returned 1 [0190.993] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0190.993] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0190.993] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0190.994] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0190.994] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.994] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0190.994] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a510, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0190.994] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0190.994] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a510) returned 0x10ab [0190.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0190.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\30323438323342333946424541434344423543303634323641383136384539395F3644354341423136314131433635333632413931334432394245303944393142" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\30323438323342333946424541434344423543303634323641383136384539395f3644354341423136314131433635333632413931334432394245303944393142"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0190.995] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x190 [0190.995] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0190.995] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0191.068] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x190, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0191.069] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0191.070] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.094] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.105] CloseHandle (hObject=0x100) returned 1 [0191.105] CloseHandle (hObject=0x104) returned 1 [0191.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\30323438323342333946424541434344423543303634323641383136384539395F3644354341423136314131433635333632413931334432394245303944393142" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\30323438323342333946424541434344423543303634323641383136384539395f3644354341423136314131433635333632413931334432394245303944393142")) returned 0 [0191.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\30323438323342333946424541434344423543303634323641383136384539395F3644354341423136314131433635333632413931334432394245303944393142" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\30323438323342333946424541434344423543303634323641383136384539395f3644354341423136314131433635333632413931334432394245303944393142")) returned 0x2020 [0191.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 0x325018 [0191.106] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 0 [0191.107] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0191.107] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b")) returned 1 [0191.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b")) returned 0xffffffff [0191.107] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0191.108] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0191.108] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.108] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0191.108] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0191.108] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.108] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa84) returned 0x10ab [0191.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0191.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\30463135383346464634324646463437364130393830314143423639323133465F4533463441384339363435344437443334343144324331424345383146383735" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\30463135383346464634324646463437364130393830314143423639323133465f4533463441384339363435344437443334343144324331424345383146383735"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0191.110] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x166 [0191.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0191.110] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0191.197] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x166, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x166, lpOverlapped=0x0) returned 1 [0191.198] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x170, lpOverlapped=0x0) returned 1 [0191.199] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.221] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.231] CloseHandle (hObject=0x104) returned 1 [0191.231] CloseHandle (hObject=0x100) returned 1 [0191.231] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\30463135383346464634324646463437364130393830314143423639323133465F4533463441384339363435344437443334343144324331424345383146383735" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\30463135383346464634324646463437364130393830314143423639323133465f4533463441384339363435344437443334343144324331424345383146383735")) returned 0 [0191.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\30463135383346464634324646463437364130393830314143423639323133465F4533463441384339363435344437443334343144324331424345383146383735" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\30463135383346464634324646463437364130393830314143423639323133465f4533463441384339363435344437443334343144324331424345383146383735")) returned 0x2020 [0191.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 0x325018 [0191.232] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 0 [0191.233] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0191.233] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875")) returned 1 [0191.233] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875")) returned 0xffffffff [0191.233] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0191.234] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0191.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0191.234] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29790, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0191.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29790) returned 0x10ab [0191.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0191.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\31424230394245454331353532353838333543313933413741413835414135425F4137423242353341463241313245324342304134314239364432314437393733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\31424230394245454331353532353838333543313933413741413835414135425f4137423242353341463241313245324342304134314239364432314437393733"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0191.235] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194 [0191.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0191.235] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0191.322] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x194, lpOverlapped=0x0) returned 1 [0191.323] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0191.324] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.346] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.357] CloseHandle (hObject=0x100) returned 1 [0191.357] CloseHandle (hObject=0x104) returned 1 [0191.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\31424230394245454331353532353838333543313933413741413835414135425F4137423242353341463241313245324342304134314239364432314437393733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\31424230394245454331353532353838333543313933413741413835414135425f4137423242353341463241313245324342304134314239364432314437393733")) returned 0 [0191.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\31424230394245454331353532353838333543313933413741413835414135425F4137423242353341463241313245324342304134314239364432314437393733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\31424230394245454331353532353838333543313933413741413835414135425f4137423242353341463241313245324342304134314239364432314437393733")) returned 0x2020 [0191.359] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 0x325018 [0191.359] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 0 [0191.359] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0191.359] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973")) returned 1 [0191.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973")) returned 0xffffffff [0191.360] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0191.360] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0191.360] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.360] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0191.360] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29cf0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0191.360] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.360] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29cf0) returned 0x10ab [0191.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1daf2884ec4dfa96ba4a58d4dbc9c406"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0191.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3144414632383834454334444641393642413441353844344442433943343036" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3144414632383834454334444641393642413441353844344442433943343036"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0191.362] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c [0191.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0191.362] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0191.452] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x10c, lpOverlapped=0x0) returned 1 [0191.454] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0191.455] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.476] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.487] CloseHandle (hObject=0x104) returned 1 [0191.487] CloseHandle (hObject=0x100) returned 1 [0191.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1daf2884ec4dfa96ba4a58d4dbc9c406"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3144414632383834454334444641393642413441353844344442433943343036" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3144414632383834454334444641393642413441353844344442433943343036")) returned 0 [0191.488] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3144414632383834454334444641393642413441353844344442433943343036" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3144414632383834454334444641393642413441353844344442433943343036")) returned 0x2020 [0191.488] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 0x325018 [0191.489] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 0 [0191.489] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0191.489] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1daf2884ec4dfa96ba4a58d4dbc9c406")) returned 1 [0191.490] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1daf2884ec4dfa96ba4a58d4dbc9c406")) returned 0xffffffff [0191.490] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0191.490] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0191.490] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.490] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0191.490] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a0d8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0191.490] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.490] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a0d8) returned 0x10ab [0191.490] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\23b523c9e7746f715d33c6527c18eb9d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0191.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3233423532334339453737343646373135443333433635323743313845423944" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3233423532334339453737343646373135443333433635323743313845423944"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0191.491] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124 [0191.491] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0191.492] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0191.590] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x124, lpOverlapped=0x0) returned 1 [0191.591] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x130, lpOverlapped=0x0) returned 1 [0191.595] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.629] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.642] CloseHandle (hObject=0x100) returned 1 [0191.642] CloseHandle (hObject=0x104) returned 1 [0191.644] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\23b523c9e7746f715d33c6527c18eb9d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3233423532334339453737343646373135443333433635323743313845423944" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3233423532334339453737343646373135443333433635323743313845423944")) returned 0 [0191.645] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3233423532334339453737343646373135443333433635323743313845423944" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3233423532334339453737343646373135443333433635323743313845423944")) returned 0x2020 [0191.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 0x325018 [0191.645] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 0 [0191.645] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0191.645] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\23b523c9e7746f715d33c6527c18eb9d")) returned 1 [0191.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\23b523c9e7746f715d33c6527c18eb9d")) returned 0xffffffff [0191.646] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0191.649] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0191.649] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.652] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0191.652] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a35c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0191.652] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.652] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a35c) returned 0x10ab [0191.652] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0191.652] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3331333042313837314131323635323041384334373836314546453345443444" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3331333042313837314131323635323041384334373836314546453345443444"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0191.653] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc [0191.653] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0191.653] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0191.740] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xdc, lpOverlapped=0x0) returned 1 [0191.741] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xe0, lpOverlapped=0x0) returned 1 [0191.742] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.764] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.774] CloseHandle (hObject=0x104) returned 1 [0191.774] CloseHandle (hObject=0x100) returned 1 [0191.775] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3331333042313837314131323635323041384334373836314546453345443444" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3331333042313837314131323635323041384334373836314546453345443444")) returned 0 [0191.775] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3331333042313837314131323635323041384334373836314546453345443444" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3331333042313837314131323635323041384334373836314546453345443444")) returned 0x2020 [0191.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 0x325018 [0191.775] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 0 [0191.775] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0191.776] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d")) returned 1 [0191.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d")) returned 0xffffffff [0191.776] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0191.777] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0191.777] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.777] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0191.777] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a788, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0191.777] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.777] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a788) returned 0x10ab [0191.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0191.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\33333838454343334637424334413932373143313045443836323145354136355F4635354335313230343739343742373046393444453544454336443638333844" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\33333838454343334637424334413932373143313045443836323145354136355f4635354335313230343739343742373046393444453544454336443638333844"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0191.778] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18a [0191.778] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0191.778] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0191.849] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18a, lpOverlapped=0x0) returned 1 [0191.850] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0191.851] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.873] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.884] CloseHandle (hObject=0x100) returned 1 [0191.884] CloseHandle (hObject=0x104) returned 1 [0191.884] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\33333838454343334637424334413932373143313045443836323145354136355F4635354335313230343739343742373046393444453544454336443638333844" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\33333838454343334637424334413932373143313045443836323145354136355f4635354335313230343739343742373046393444453544454336443638333844")) returned 0 [0191.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\33333838454343334637424334413932373143313045443836323145354136355F4635354335313230343739343742373046393444453544454336443638333844" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\33333838454343334637424334413932373143313045443836323145354136355f4635354335313230343739343742373046393444453544454336443638333844")) returned 0x2020 [0191.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 0x325018 [0191.885] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 0 [0191.885] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0191.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d")) returned 1 [0191.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d")) returned 0xffffffff [0191.886] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0191.886] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0191.886] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.886] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0191.886] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0191.886] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0191.886] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac8c) returned 0x10ab [0191.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0191.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34304534353046374345313334313941324343433241353434353033354130415F3036463032423146313341423442313142384643363639424445353635414631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34304534353046374345313334313941324343433241353434353033354130415f3036463032423146313341423442313142384643363639424445353635414631"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0191.887] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x190 [0191.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0191.888] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0191.977] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x190, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0191.978] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0191.979] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.010] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.021] CloseHandle (hObject=0x104) returned 1 [0192.021] CloseHandle (hObject=0x100) returned 1 [0192.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34304534353046374345313334313941324343433241353434353033354130415F3036463032423146313341423442313142384643363639424445353635414631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34304534353046374345313334313941324343433241353434353033354130415f3036463032423146313341423442313142384643363639424445353635414631")) returned 0 [0192.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34304534353046374345313334313941324343433241353434353033354130415F3036463032423146313341423442313142384643363639424445353635414631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34304534353046374345313334313941324343433241353434353033354130415f3036463032423146313341423442313142384643363639424445353635414631")) returned 0x2020 [0192.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 0x325018 [0192.022] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 0 [0192.022] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0192.022] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1")) returned 1 [0192.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1")) returned 0xffffffff [0192.023] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0192.023] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0192.023] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.024] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0192.024] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29890, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0192.024] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.024] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29890) returned 0x10ab [0192.024] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0192.024] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34433846383431464230324445433843313031303830323844423836413038445F3844414646464432443433424443374131373137463542363143333033333938" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34433846383431464230324445433843313031303830323844423836413038445f3844414646464432443433424443374131373137463542363143333033333938"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0192.025] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ae [0192.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0192.025] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0192.112] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ae, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1ae, lpOverlapped=0x0) returned 1 [0192.113] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0192.114] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.137] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.148] CloseHandle (hObject=0x100) returned 1 [0192.148] CloseHandle (hObject=0x104) returned 1 [0192.148] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34433846383431464230324445433843313031303830323844423836413038445F3844414646464432443433424443374131373137463542363143333033333938" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34433846383431464230324445433843313031303830323844423836413038445f3844414646464432443433424443374131373137463542363143333033333938")) returned 0 [0192.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34433846383431464230324445433843313031303830323844423836413038445F3844414646464432443433424443374131373137463542363143333033333938" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34433846383431464230324445433843313031303830323844423836413038445f3844414646464432443433424443374131373137463542363143333033333938")) returned 0x2020 [0192.149] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 0x325018 [0192.149] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 0 [0192.149] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0192.149] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398")) returned 1 [0192.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398")) returned 0xffffffff [0192.150] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0192.150] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0192.150] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.150] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0192.151] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29da4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0192.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29da4) returned 0x10ab [0192.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0192.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34444433393732364434423535414333423431313942333541383933333233435F3436434343464239343041393346333941373334463639454643444437364539" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34444433393732364434423535414333423431313942333541383933333233435f3436434343464239343041393346333941373334463639454643444437364539"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0192.151] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194 [0192.152] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0192.152] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0192.224] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x194, lpOverlapped=0x0) returned 1 [0192.225] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0192.226] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.248] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.259] CloseHandle (hObject=0x104) returned 1 [0192.259] CloseHandle (hObject=0x100) returned 1 [0192.259] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34444433393732364434423535414333423431313942333541383933333233435F3436434343464239343041393346333941373334463639454643444437364539" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34444433393732364434423535414333423431313942333541383933333233435f3436434343464239343041393346333941373334463639454643444437364539")) returned 0 [0192.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\34444433393732364434423535414333423431313942333541383933333233435F3436434343464239343041393346333941373334463639454643444437364539" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\34444433393732364434423535414333423431313942333541383933333233435f3436434343464239343041393346333941373334463639454643444437364539")) returned 0x2020 [0192.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 0x325018 [0192.260] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 0 [0192.261] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0192.261] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9")) returned 1 [0192.261] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9")) returned 0xffffffff [0192.261] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0192.262] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0192.262] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.262] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0192.262] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a318, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0192.262] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.262] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a318) returned 0x10ab [0192.262] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0192.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35303830444337413635444236413539363045434438373430383846333332385F3239303846363832444643383141373933424432343043463239373131433737" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35303830444337413635444236413539363045434438373430383846333332385f3239303846363832444643383141373933424432343043463239373131433737"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0192.263] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194 [0192.263] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0192.264] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0192.351] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x194, lpOverlapped=0x0) returned 1 [0192.352] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0192.353] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.376] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.386] CloseHandle (hObject=0x100) returned 1 [0192.386] CloseHandle (hObject=0x104) returned 1 [0192.386] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35303830444337413635444236413539363045434438373430383846333332385F3239303846363832444643383141373933424432343043463239373131433737" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35303830444337413635444236413539363045434438373430383846333332385f3239303846363832444643383141373933424432343043463239373131433737")) returned 0 [0192.406] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35303830444337413635444236413539363045434438373430383846333332385F3239303846363832444643383141373933424432343043463239373131433737" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35303830444337413635444236413539363045434438373430383846333332385f3239303846363832444643383141373933424432343043463239373131433737")) returned 0x2020 [0192.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 0x325018 [0192.406] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 0 [0192.406] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0192.406] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77")) returned 1 [0192.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77")) returned 0xffffffff [0192.407] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0192.408] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0192.408] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.408] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0192.408] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a88c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0192.408] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.408] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a88c) returned 0x10ab [0192.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0192.409] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35303830444337413635444236413539363045434438373430383846333332385F3643424132433036443539383544443935414535394146384643374336323230" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35303830444337413635444236413539363045434438373430383846333332385f3643424132433036443539383544443935414535394146384643374336323230"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0192.415] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x190 [0192.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0192.415] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0192.488] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x190, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0192.489] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0192.490] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.512] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.523] CloseHandle (hObject=0x104) returned 1 [0192.523] CloseHandle (hObject=0x100) returned 1 [0192.523] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35303830444337413635444236413539363045434438373430383846333332385F3643424132433036443539383544443935414535394146384643374336323230" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35303830444337413635444236413539363045434438373430383846333332385f3643424132433036443539383544443935414535394146384643374336323230")) returned 0 [0192.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35303830444337413635444236413539363045434438373430383846333332385F3643424132433036443539383544443935414535394146384643374336323230" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35303830444337413635444236413539363045434438373430383846333332385f3643424132433036443539383544443935414535394146384643374336323230")) returned 0x2020 [0192.524] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 0x325018 [0192.524] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 0 [0192.524] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0192.524] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220")) returned 1 [0192.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220")) returned 0xffffffff [0192.525] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0192.526] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0192.526] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.526] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0192.526] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0192.526] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.526] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acec) returned 0x10ab [0192.526] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0192.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35343537413843453442324137343939463832393941303133423645314337435F4345353046383933383831443433444330433831354534443830464146324234" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35343537413843453442324137343939463832393941303133423645314337435f4345353046383933383831443433444330433831354534443830464146324234"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0192.529] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18e [0192.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0192.529] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0192.617] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18e, lpOverlapped=0x0) returned 1 [0192.618] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0192.619] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.641] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.652] CloseHandle (hObject=0x100) returned 1 [0192.652] CloseHandle (hObject=0x104) returned 1 [0192.653] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35343537413843453442324137343939463832393941303133423645314337435F4345353046383933383831443433444330433831354534443830464146324234" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35343537413843453442324137343939463832393941303133423645314337435f4345353046383933383831443433444330433831354534443830464146324234")) returned 0 [0192.653] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\35343537413843453442324137343939463832393941303133423645314337435F4345353046383933383831443433444330433831354534443830464146324234" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\35343537413843453442324137343939463832393941303133423645314337435f4345353046383933383831443433444330433831354534443830464146324234")) returned 0x2020 [0192.653] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 0x325018 [0192.654] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 0 [0192.654] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0192.654] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4")) returned 1 [0192.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4")) returned 0xffffffff [0192.655] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0192.655] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0192.655] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.655] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0192.655] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29990, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0192.655] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.655] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29990) returned 0x10ab [0192.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\696f3de637e6de85b458996d49d759ad"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0192.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3639364633444536333745364445383542343538393936443439443735394144" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3639364633444536333745364445383542343538393936443439443735394144"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0192.656] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf4 [0192.656] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0192.656] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0192.743] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xf4, lpOverlapped=0x0) returned 1 [0192.744] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x100, lpOverlapped=0x0) returned 1 [0192.745] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.768] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.779] CloseHandle (hObject=0x104) returned 1 [0192.779] CloseHandle (hObject=0x100) returned 1 [0192.779] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\696f3de637e6de85b458996d49d759ad"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3639364633444536333745364445383542343538393936443439443735394144" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3639364633444536333745364445383542343538393936443439443735394144")) returned 0 [0192.779] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3639364633444536333745364445383542343538393936443439443735394144" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3639364633444536333745364445383542343538393936443439443735394144")) returned 0x2020 [0192.780] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 0x325018 [0192.780] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 0 [0192.780] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0192.780] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\696f3de637e6de85b458996d49d759ad")) returned 1 [0192.781] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\696f3de637e6de85b458996d49d759ad")) returned 0xffffffff [0192.781] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0192.781] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0192.781] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.781] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0192.781] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29dbc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0192.781] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.781] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29dbc) returned 0x10ab [0192.781] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0192.782] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37303541373644453731454132434145424238463039303734343943453038365F3937353243354232443533454537413139463737363442353239363845433231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37303541373644453731454132434145424238463039303734343943453038365f3937353243354232443533454537413139463737363442353239363845433231"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0192.782] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18e [0192.782] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0192.783] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0192.857] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18e, lpOverlapped=0x0) returned 1 [0192.857] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0192.858] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.881] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.892] CloseHandle (hObject=0x100) returned 1 [0192.892] CloseHandle (hObject=0x104) returned 1 [0192.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37303541373644453731454132434145424238463039303734343943453038365F3937353243354232443533454537413139463737363442353239363845433231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37303541373644453731454132434145424238463039303734343943453038365f3937353243354232443533454537413139463737363442353239363845433231")) returned 0 [0192.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37303541373644453731454132434145424238463039303734343943453038365F3937353243354232443533454537413139463737363442353239363845433231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37303541373644453731454132434145424238463039303734343943453038365f3937353243354232443533454537413139463737363442353239363845433231")) returned 0x2020 [0192.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 0x325018 [0192.893] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 0 [0192.893] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0192.893] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21")) returned 1 [0192.894] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21")) returned 0xffffffff [0192.894] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0192.894] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0192.894] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.895] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0192.895] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0192.895] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0192.895] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2ac) returned 0x10ab [0192.895] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0192.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3733393643343230413845314243314441393746314146304431304241443231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3733393643343230413845314243314441393746314146304431304241443231"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0192.917] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0192.917] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0192.917] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0193.005] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x100, lpOverlapped=0x0) returned 1 [0193.006] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0193.007] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.030] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.041] CloseHandle (hObject=0x104) returned 1 [0193.041] CloseHandle (hObject=0x100) returned 1 [0193.041] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3733393643343230413845314243314441393746314146304431304241443231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3733393643343230413845314243314441393746314146304431304241443231")) returned 0 [0193.042] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3733393643343230413845314243314441393746314146304431304241443231" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3733393643343230413845314243314441393746314146304431304241443231")) returned 0x2020 [0193.042] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 0x325018 [0193.042] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 0 [0193.042] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0193.042] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21")) returned 1 [0193.043] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21")) returned 0xffffffff [0193.043] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0193.044] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0193.044] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.044] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0193.044] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a6d8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0193.044] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.044] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a6d8) returned 0x10ab [0193.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0193.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37343233463838433746323635463044454643303845413838433342444534355F4439373542424138303333313735433844313132303233443841374138414436" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37343233463838433746323635463044454643303845413838433342444534355f4439373542424138303333313735433844313132303233443841374138414436"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0193.049] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b2 [0193.049] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0193.049] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0193.137] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1b2, lpOverlapped=0x0) returned 1 [0193.138] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1c0, lpOverlapped=0x0) returned 1 [0193.138] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.165] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.176] CloseHandle (hObject=0x100) returned 1 [0193.177] CloseHandle (hObject=0x104) returned 1 [0193.177] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37343233463838433746323635463044454643303845413838433342444534355F4439373542424138303333313735433844313132303233443841374138414436" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37343233463838433746323635463044454643303845413838433342444534355f4439373542424138303333313735433844313132303233443841374138414436")) returned 0 [0193.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37343233463838433746323635463044454643303845413838433342444534355F4439373542424138303333313735433844313132303233443841374138414436" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37343233463838433746323635463044454643303845413838433342444534355f4439373542424138303333313735433844313132303233443841374138414436")) returned 0x2020 [0193.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 0x325018 [0193.178] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 0 [0193.178] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0193.178] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6")) returned 1 [0193.179] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6")) returned 0xffffffff [0193.179] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0193.180] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0193.180] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.180] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0193.180] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abc8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0193.180] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.180] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abc8) returned 0x10ab [0193.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0193.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3742323233384141434345444333463146464538453745423546353735454339" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3742323233384141434345444333463146464538453745423546353735454339"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0193.181] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc [0193.181] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0193.181] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0193.275] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xdc, lpOverlapped=0x0) returned 1 [0193.276] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xe0, lpOverlapped=0x0) returned 1 [0193.277] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.299] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.310] CloseHandle (hObject=0x104) returned 1 [0193.310] CloseHandle (hObject=0x100) returned 1 [0193.311] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3742323233384141434345444333463146464538453745423546353735454339" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3742323233384141434345444333463146464538453745423546353735454339")) returned 0 [0193.311] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3742323233384141434345444333463146464538453745423546353735454339" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3742323233384141434345444333463146464538453745423546353735454339")) returned 0x2020 [0193.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 0x325018 [0193.312] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 0 [0193.312] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0193.312] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9")) returned 1 [0193.313] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9")) returned 0xffffffff [0193.313] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0193.313] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0193.313] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.313] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0193.313] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abc8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0193.313] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.314] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abc8) returned 0x10ab [0193.314] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0193.315] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37423839343442413841443045464446304530314134334546363242454344305F4232444231434334423546324432413830324435364141454435323538303244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37423839343442413841443045464446304530314134334546363242454344305f4232444231434334423546324432413830324435364141454435323538303244"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0193.315] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194 [0193.315] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0193.316] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0193.416] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x194, lpOverlapped=0x0) returned 1 [0193.417] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0193.418] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.440] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.451] CloseHandle (hObject=0x100) returned 1 [0193.451] CloseHandle (hObject=0x104) returned 1 [0193.452] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37423839343442413841443045464446304530314134334546363242454344305F4232444231434334423546324432413830324435364141454435323538303244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37423839343442413841443045464446304530314134334546363242454344305f4232444231434334423546324432413830324435364141454435323538303244")) returned 0 [0193.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37423839343442413841443045464446304530314134334546363242454344305F4232444231434334423546324432413830324435364141454435323538303244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37423839343442413841443045464446304530314134334546363242454344305f4232444231434334423546324432413830324435364141454435323538303244")) returned 0x2020 [0193.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 0x325018 [0193.453] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 0 [0193.453] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0193.453] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d")) returned 1 [0193.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d")) returned 0xffffffff [0193.454] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0193.455] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0193.455] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.455] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0193.455] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29fac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0193.455] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.455] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29fac) returned 0x10ab [0193.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0193.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37443236364439453145363946413145454642393639394230303942333443385F3041394246444437354235393843323131304342463631304330373845364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37443236364439453145363946413145454642393639394230303942333443385f3041394246444437354235393843323131304342463631304330373845364536"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0193.456] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194 [0193.456] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0193.456] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0193.528] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x194, lpOverlapped=0x0) returned 1 [0193.529] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0193.530] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.552] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.563] CloseHandle (hObject=0x104) returned 1 [0193.563] CloseHandle (hObject=0x100) returned 1 [0193.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37443236364439453145363946413145454642393639394230303942333443385F3041394246444437354235393843323131304342463631304330373845364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37443236364439453145363946413145454642393639394230303942333443385f3041394246444437354235393843323131304342463631304330373845364536")) returned 0 [0193.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37443236364439453145363946413145454642393639394230303942333443385F3041394246444437354235393843323131304342463631304330373845364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37443236364439453145363946413145454642393639394230303942333443385f3041394246444437354235393843323131304342463631304330373845364536")) returned 0x2020 [0193.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 0x325018 [0193.565] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 0 [0193.565] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0193.565] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6")) returned 1 [0193.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6")) returned 0xffffffff [0193.566] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0193.566] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0193.566] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.566] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0193.566] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a520, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0193.566] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.566] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a520) returned 0x10ab [0193.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0193.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37443236364439453145363946413145454642393639394230303942333443385F3144354138373641393131334543303732323443343545354138373045334244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37443236364439453145363946413145454642393639394230303942333443385f3144354138373641393131334543303732323443343545354138373045334244"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0193.567] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x198 [0193.567] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0193.568] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0193.666] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x198, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x198, lpOverlapped=0x0) returned 1 [0193.667] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0193.668] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.691] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.701] CloseHandle (hObject=0x100) returned 1 [0193.701] CloseHandle (hObject=0x104) returned 1 [0193.701] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37443236364439453145363946413145454642393639394230303942333443385F3144354138373641393131334543303732323443343545354138373045334244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37443236364439453145363946413145454642393639394230303942333443385f3144354138373641393131334543303732323443343545354138373045334244")) returned 0 [0193.702] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37443236364439453145363946413145454642393639394230303942333443385F3144354138373641393131334543303732323443343545354138373045334244" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\37443236364439453145363946413145454642393639394230303942333443385f3144354138373641393131334543303732323443343545354138373045334244")) returned 0x2020 [0193.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 0x325018 [0193.702] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 0 [0193.703] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0193.703] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd")) returned 1 [0193.703] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd")) returned 0xffffffff [0193.703] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0193.704] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0193.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0193.704] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa94, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0193.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa94) returned 0x10ab [0193.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0193.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3233344342354436343730354434444242344441383339373136333539414630" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3233344342354436343730354434444242344441383339373136333539414630"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0193.706] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182 [0193.706] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0193.707] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0193.794] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x182, lpOverlapped=0x0) returned 1 [0193.795] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0193.796] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.818] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.829] CloseHandle (hObject=0x104) returned 1 [0193.829] CloseHandle (hObject=0x100) returned 1 [0193.829] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3233344342354436343730354434444242344441383339373136333539414630" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3233344342354436343730354434444242344441383339373136333539414630")) returned 0 [0193.830] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3233344342354436343730354434444242344441383339373136333539414630" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3233344342354436343730354434444242344441383339373136333539414630")) returned 0x2020 [0193.830] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 0x325018 [0193.830] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 0 [0193.830] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0193.830] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0")) returned 1 [0193.831] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0")) returned 0xffffffff [0193.831] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0193.832] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0193.832] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.832] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0193.832] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29790, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0193.832] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.832] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29790) returned 0x10ab [0193.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0193.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3239343131304436393930454533393233323746384136303644353542433145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3239343131304436393930454533393233323746384136303644353542433145"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0193.833] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186 [0193.833] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0193.833] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0193.925] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x186, lpOverlapped=0x0) returned 1 [0193.927] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0193.928] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.951] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.961] CloseHandle (hObject=0x100) returned 1 [0193.961] CloseHandle (hObject=0x104) returned 1 [0193.962] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3239343131304436393930454533393233323746384136303644353542433145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3239343131304436393930454533393233323746384136303644353542433145")) returned 0 [0193.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3239343131304436393930454533393233323746384136303644353542433145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3239343131304436393930454533393233323746384136303644353542433145")) returned 0x2020 [0193.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 0x325018 [0193.963] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 0 [0193.963] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0193.963] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e")) returned 1 [0193.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e")) returned 0xffffffff [0193.964] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0193.965] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0193.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0193.965] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d04, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0193.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0193.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d04) returned 0x10ab [0193.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0193.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3530313637393039464346453043363631353346313930313433394342424131" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3530313637393039464346453043363631353346313930313433394342424131"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0193.966] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186 [0193.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0193.966] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0194.047] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x186, lpOverlapped=0x0) returned 1 [0194.049] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0194.050] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.072] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.083] CloseHandle (hObject=0x104) returned 1 [0194.083] CloseHandle (hObject=0x100) returned 1 [0194.083] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3530313637393039464346453043363631353346313930313433394342424131" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3530313637393039464346453043363631353346313930313433394342424131")) returned 0 [0194.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3530313637393039464346453043363631353346313930313433394342424131" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3530313637393039464346453043363631353346313930313433394342424131")) returned 0x2020 [0194.084] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 0x325018 [0194.084] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 0 [0194.084] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0194.084] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1")) returned 1 [0194.085] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1")) returned 0xffffffff [0194.085] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0194.086] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0194.086] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.086] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0194.086] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a278, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0194.086] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.086] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a278) returned 0x10ab [0194.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0194.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3538314339303444423539323445343641364331413836333736313441343045" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3538314339303444423539323445343641364331413836333736313441343045"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0194.090] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182 [0194.090] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0194.090] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0194.177] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x182, lpOverlapped=0x0) returned 1 [0194.178] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0194.179] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.201] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.212] CloseHandle (hObject=0x100) returned 1 [0194.212] CloseHandle (hObject=0x104) returned 1 [0194.212] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3538314339303444423539323445343641364331413836333736313441343045" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3538314339303444423539323445343641364331413836333736313441343045")) returned 0 [0194.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3538314339303444423539323445343641364331413836333736313441343045" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3538314339303444423539323445343641364331413836333736313441343045")) returned 0x2020 [0194.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 0x325018 [0194.214] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 0 [0194.214] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0194.214] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e")) returned 1 [0194.214] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e")) returned 0xffffffff [0194.214] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0194.215] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0194.215] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.215] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0194.215] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a7ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0194.215] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.215] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a7ec) returned 0x10ab [0194.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0194.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3545413635383434423945463536373041394330303243424438354231304134" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3545413635383434423945463536373041394330303243424438354231304134"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0194.216] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182 [0194.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0194.217] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0194.303] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x182, lpOverlapped=0x0) returned 1 [0194.304] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0194.305] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.328] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.339] CloseHandle (hObject=0x104) returned 1 [0194.339] CloseHandle (hObject=0x100) returned 1 [0194.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3545413635383434423945463536373041394330303243424438354231304134" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3545413635383434423945463536373041394330303243424438354231304134")) returned 0 [0194.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3545413635383434423945463536373041394330303243424438354231304134" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3545413635383434423945463536373041394330303243424438354231304134")) returned 0x2020 [0194.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 0x325018 [0194.340] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 0 [0194.340] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0194.340] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4")) returned 1 [0194.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4")) returned 0xffffffff [0194.342] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0194.342] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0194.342] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.343] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0194.343] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0194.343] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.343] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac4c) returned 0x10ab [0194.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0194.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3734453934334637444142364431394533374534383534303537313535373738" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3734453934334637444142364431394533374534383534303537313535373738"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0194.344] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182 [0194.344] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0194.344] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0194.440] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x182, lpOverlapped=0x0) returned 1 [0194.440] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0194.441] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.464] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.475] CloseHandle (hObject=0x100) returned 1 [0194.475] CloseHandle (hObject=0x104) returned 1 [0194.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3734453934334637444142364431394533374534383534303537313535373738" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3734453934334637444142364431394533374534383534303537313535373738")) returned 0 [0194.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F3734453934334637444142364431394533374534383534303537313535373738" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f3734453934334637444142364431394533374534383534303537313535373738")) returned 0x2020 [0194.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 0x325018 [0194.476] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 0 [0194.476] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0194.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778")) returned 1 [0194.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778")) returned 0xffffffff [0194.477] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0194.478] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0194.478] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.478] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0194.478] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c299a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0194.478] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.478] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c299a4) returned 0x10ab [0194.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0194.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4330383044413241453433314331413746334230433134374545423034334544" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4330383044413241453433314331413746334230433134374545423034334544"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0194.479] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186 [0194.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0194.479] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0194.572] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x186, lpOverlapped=0x0) returned 1 [0194.573] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0194.575] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.609] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.620] CloseHandle (hObject=0x104) returned 1 [0194.620] CloseHandle (hObject=0x100) returned 1 [0194.620] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4330383044413241453433314331413746334230433134374545423034334544" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4330383044413241453433314331413746334230433134374545423034334544")) returned 0 [0194.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4330383044413241453433314331413746334230433134374545423034334544" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4330383044413241453433314331413746334230433134374545423034334544")) returned 0x2020 [0194.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 0x325018 [0194.622] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 0 [0194.622] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0194.622] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed")) returned 1 [0194.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed")) returned 0xffffffff [0194.623] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0194.624] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0194.624] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.624] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0194.624] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f18, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0194.624] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.624] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f18) returned 0x10ab [0194.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0194.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4539303744374130343635373731344235423036443138424339323039373145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4539303744374130343635373731344235423036443138424339323039373145"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0194.626] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186 [0194.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0194.626] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0194.698] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x186, lpOverlapped=0x0) returned 1 [0194.699] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0194.700] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.722] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.733] CloseHandle (hObject=0x100) returned 1 [0194.733] CloseHandle (hObject=0x104) returned 1 [0194.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4539303744374130343635373731344235423036443138424339323039373145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4539303744374130343635373731344235423036443138424339323039373145")) returned 0 [0194.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4539303744374130343635373731344235423036443138424339323039373145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4539303744374130343635373731344235423036443138424339323039373145")) returned 0x2020 [0194.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 0x325018 [0194.734] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 0 [0194.734] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0194.734] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e")) returned 1 [0194.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e")) returned 0xffffffff [0194.735] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0194.735] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0194.735] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.735] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0194.735] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a48c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0194.735] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.735] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a48c) returned 0x10ab [0194.735] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0194.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4632333138463741423333393830413133314132363534353443333943413330" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4632333138463741423333393830413133314132363534353443333943413330"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0194.736] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182 [0194.736] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0194.737] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0194.827] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x182, lpOverlapped=0x0) returned 1 [0194.828] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0194.829] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.851] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.862] CloseHandle (hObject=0x104) returned 1 [0194.862] CloseHandle (hObject=0x100) returned 1 [0194.862] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4632333138463741423333393830413133314132363534353443333943413330" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4632333138463741423333393830413133314132363534353443333943413330")) returned 0 [0194.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4632333138463741423333393830413133314132363534353443333943413330" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4632333138463741423333393830413133314132363534353443333943413330")) returned 0x2020 [0194.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 0x325018 [0194.863] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 0 [0194.863] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0194.863] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30")) returned 1 [0194.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30")) returned 0xffffffff [0194.864] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0194.865] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0194.865] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.865] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0194.865] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0194.865] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.865] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa00) returned 0x10ab [0194.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0194.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4636453135373738444338453332363839354336303646424641303339324542" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4636453135373738444338453332363839354336303646424641303339324542"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0194.866] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186 [0194.866] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0194.867] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0194.958] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x186, lpOverlapped=0x0) returned 1 [0194.959] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0194.960] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.982] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.993] CloseHandle (hObject=0x100) returned 1 [0194.993] CloseHandle (hObject=0x104) returned 1 [0194.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4636453135373738444338453332363839354336303646424641303339324542" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4636453135373738444338453332363839354336303646424641303339324542")) returned 0 [0194.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38303539453941304433313438373745343046453933443843434642334336395F4636453135373738444338453332363839354336303646424641303339324542" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38303539453941304433313438373745343046453933443843434642334336395f4636453135373738444338453332363839354336303646424641303339324542")) returned 0x2020 [0194.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 0x325018 [0194.995] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 0 [0194.995] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0194.995] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb")) returned 1 [0194.996] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb")) returned 0xffffffff [0194.996] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0194.996] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0194.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0194.997] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29790, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0194.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0194.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29790) returned 0x10ab [0194.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0194.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38323832393838323445413535343939343743313744444142463638373146355F3032303645464243353430333030433342463031363343444243334437443536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38323832393838323445413535343939343743313744444142463638373146355f3032303645464243353430333030433342463031363343444243334437443536"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0194.998] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x180 [0194.998] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0194.998] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0195.084] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x180, lpOverlapped=0x0) returned 1 [0195.086] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0195.087] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.109] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.120] CloseHandle (hObject=0x104) returned 1 [0195.120] CloseHandle (hObject=0x100) returned 1 [0195.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38323832393838323445413535343939343743313744444142463638373146355F3032303645464243353430333030433342463031363343444243334437443536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38323832393838323445413535343939343743313744444142463638373146355f3032303645464243353430333030433342463031363343444243334437443536")) returned 0 [0195.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38323832393838323445413535343939343743313744444142463638373146355F3032303645464243353430333030433342463031363343444243334437443536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38323832393838323445413535343939343743313744444142463638373146355f3032303645464243353430333030433342463031363343444243334437443536")) returned 0x2020 [0195.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 0x325018 [0195.121] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 0 [0195.121] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0195.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56")) returned 1 [0195.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56")) returned 0xffffffff [0195.122] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0195.123] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0195.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0195.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29bc8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0195.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29bc8) returned 0x10ab [0195.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0195.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38383238463339433743304345394131344232354337454233323131383142415F3344463934454237393730393636373446373739334135363241373738433546" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38383238463339433743304345394131344232354337454233323131383142415f3344463934454237393730393636373446373739334135363241373738433546"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0195.124] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x188 [0195.124] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0195.125] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0195.212] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x188, lpOverlapped=0x0) returned 1 [0195.213] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0195.214] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.236] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.247] CloseHandle (hObject=0x100) returned 1 [0195.247] CloseHandle (hObject=0x104) returned 1 [0195.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38383238463339433743304345394131344232354337454233323131383142415F3344463934454237393730393636373446373739334135363241373738433546" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38383238463339433743304345394131344232354337454233323131383142415f3344463934454237393730393636373446373739334135363241373738433546")) returned 0 [0195.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38383238463339433743304345394131344232354337454233323131383142415F3344463934454237393730393636373446373739334135363241373738433546" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38383238463339433743304345394131344232354337454233323131383142415f3344463934454237393730393636373446373739334135363241373738433546")) returned 0x2020 [0195.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 0x325018 [0195.249] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 0 [0195.249] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0195.249] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f")) returned 1 [0195.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f")) returned 0xffffffff [0195.250] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0195.251] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0195.251] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.251] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0195.251] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0195.251] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.251] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0195.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0195.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38383238463339433743304345394131344232354337454233323131383142415F4336454637334534343832423235383842313235324431413634423939343136" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38383238463339433743304345394131344232354337454233323131383142415f4336454637334534343832423235383842313235324431413634423939343136"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0195.252] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x188 [0195.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0195.252] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0195.340] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x188, lpOverlapped=0x0) returned 1 [0195.341] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0195.342] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.364] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.375] CloseHandle (hObject=0x104) returned 1 [0195.375] CloseHandle (hObject=0x100) returned 1 [0195.375] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38383238463339433743304345394131344232354337454233323131383142415F4336454637334534343832423235383842313235324431413634423939343136" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38383238463339433743304345394131344232354337454233323131383142415f4336454637334534343832423235383842313235324431413634423939343136")) returned 0 [0195.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38383238463339433743304345394131344232354337454233323131383142415F4336454637334534343832423235383842313235324431413634423939343136" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38383238463339433743304345394131344232354337454233323131383142415f4336454637334534343832423235383842313235324431413634423939343136")) returned 0x2020 [0195.376] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 0x325018 [0195.376] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 0 [0195.376] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0195.377] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416")) returned 1 [0195.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416")) returned 0xffffffff [0195.377] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0195.378] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0195.378] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.378] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0195.378] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a220, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0195.378] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.378] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a220) returned 0x10ab [0195.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0195.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38453445353130463434413536423843384543464543333532393037433337335F3431313134303039384437314630323831333445394238413231323535433631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38453445353130463434413536423843384543464543333532393037433337335f3431313134303039384437314630323831333445394238413231323535433631"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0195.380] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x196 [0195.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0195.380] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0195.489] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x196, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x196, lpOverlapped=0x0) returned 1 [0195.490] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0195.491] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.513] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.524] CloseHandle (hObject=0x100) returned 1 [0195.524] CloseHandle (hObject=0x104) returned 1 [0195.524] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38453445353130463434413536423843384543464543333532393037433337335F3431313134303039384437314630323831333445394238413231323535433631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38453445353130463434413536423843384543464543333532393037433337335f3431313134303039384437314630323831333445394238413231323535433631")) returned 0 [0195.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\38453445353130463434413536423843384543464543333532393037433337335F3431313134303039384437314630323831333445394238413231323535433631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\38453445353130463434413536423843384543464543333532393037433337335f3431313134303039384437314630323831333445394238413231323535433631")) returned 0x2020 [0195.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 0x325018 [0195.525] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 0 [0195.525] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0195.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61")) returned 1 [0195.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61")) returned 0xffffffff [0195.526] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0195.527] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0195.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0195.527] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2840c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0195.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2840c) returned 0x10ab [0195.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0195.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3934333038303539423537423331343245343535423338413645423932303135" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3934333038303539423537423331343245343535423338413645423932303135"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0195.528] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x156 [0195.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0195.529] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0195.625] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x156, lpOverlapped=0x0) returned 1 [0195.628] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x160, lpOverlapped=0x0) returned 1 [0195.628] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.651] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.662] CloseHandle (hObject=0x104) returned 1 [0195.662] CloseHandle (hObject=0x100) returned 1 [0195.662] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3934333038303539423537423331343245343535423338413645423932303135" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3934333038303539423537423331343245343535423338413645423932303135")) returned 0 [0195.663] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3934333038303539423537423331343245343535423338413645423932303135" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3934333038303539423537423331343245343535423338413645423932303135")) returned 0x2020 [0195.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0x325018 [0195.663] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0 [0195.663] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0195.663] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015")) returned 1 [0195.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015")) returned 0xffffffff [0195.664] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0195.665] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0195.665] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.665] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0195.665] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a838, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0195.665] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.665] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a838) returned 0x10ab [0195.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0195.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39353543414236464636413234443538323044353042354241314346373943375F4144394537363135323937413341383333323041414345353830314130344639" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39353543414236464636413234443538323044353042354241314346373943375f4144394537363135323937413341383333323041414345353830314130344639"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0195.666] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194 [0195.666] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0195.666] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0195.753] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x194, lpOverlapped=0x0) returned 1 [0195.753] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0195.754] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.776] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.787] CloseHandle (hObject=0x100) returned 1 [0195.787] CloseHandle (hObject=0x104) returned 1 [0195.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39353543414236464636413234443538323044353042354241314346373943375F4144394537363135323937413341383333323041414345353830314130344639" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39353543414236464636413234443538323044353042354241314346373943375f4144394537363135323937413341383333323041414345353830314130344639")) returned 0 [0195.788] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39353543414236464636413234443538323044353042354241314346373943375F4144394537363135323937413341383333323041414345353830314130344639" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39353543414236464636413234443538323044353042354241314346373943375f4144394537363135323937413341383333323041414345353830314130344639")) returned 0x2020 [0195.788] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 0x325018 [0195.788] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 0 [0195.788] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0195.788] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9")) returned 1 [0195.789] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9")) returned 0xffffffff [0195.789] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0195.790] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0195.790] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.790] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0195.790] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aab0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0195.790] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.790] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aab0) returned 0x10ab [0195.790] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0195.790] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39424332464643354439353931453142443335343532333045394237434333365F4346333039343335373146394245453936433438374232443946303433364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39424332464643354439353931453142443335343532333045394237434333365f4346333039343335373146394245453936433438374232443946303433364536"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0195.791] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186 [0195.791] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0195.791] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0195.878] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x186, lpOverlapped=0x0) returned 1 [0195.879] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0195.880] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.902] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.914] CloseHandle (hObject=0x104) returned 1 [0195.914] CloseHandle (hObject=0x100) returned 1 [0195.914] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39424332464643354439353931453142443335343532333045394237434333365F4346333039343335373146394245453936433438374232443946303433364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39424332464643354439353931453142443335343532333045394237434333365f4346333039343335373146394245453936433438374232443946303433364536")) returned 0 [0195.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39424332464643354439353931453142443335343532333045394237434333365F4346333039343335373146394245453936433438374232443946303433364536" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39424332464643354439353931453142443335343532333045394237434333365f4346333039343335373146394245453936433438374232443946303433364536")) returned 0x2020 [0195.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 0x325018 [0195.915] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 0 [0195.915] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0195.915] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6")) returned 1 [0195.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6")) returned 0xffffffff [0195.916] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0195.916] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0195.916] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.916] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0195.916] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29954, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0195.916] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0195.916] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29954) returned 0x10ab [0195.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0195.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39433838384245414243434243324139374230443644393231344333424133375F3132313344433646373145344333423035453742434545424332303341333145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39433838384245414243434243324139374230443644393231344333424133375f3132313344433646373145344333423035453742434545424332303341333145"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0195.917] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182 [0195.917] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0195.917] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0195.993] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x182, lpOverlapped=0x0) returned 1 [0195.994] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0195.995] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.017] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.028] CloseHandle (hObject=0x100) returned 1 [0196.028] CloseHandle (hObject=0x104) returned 1 [0196.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39433838384245414243434243324139374230443644393231344333424133375F3132313344433646373145344333423035453742434545424332303341333145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39433838384245414243434243324139374230443644393231344333424133375f3132313344433646373145344333423035453742434545424332303341333145")) returned 0 [0196.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39433838384245414243434243324139374230443644393231344333424133375F3132313344433646373145344333423035453742434545424332303341333145" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39433838384245414243434243324139374230443644393231344333424133375f3132313344433646373145344333423035453742434545424332303341333145")) returned 0x2020 [0196.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 0x325018 [0196.029] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 0 [0196.029] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0196.029] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e")) returned 1 [0196.030] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e")) returned 0xffffffff [0196.030] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0196.030] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0196.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0196.030] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0196.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0196.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0196.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39433838384245414243434243324139374230443644393231344333424133375F4542433735373238433631313941373745344441383535394444313046303631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39433838384245414243434243324139374230443644393231344333424133375f4542433735373238433631313941373745344441383535394444313046303631"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0196.041] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182 [0196.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0196.041] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0196.141] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x182, lpOverlapped=0x0) returned 1 [0196.142] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0196.143] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.165] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.176] CloseHandle (hObject=0x104) returned 1 [0196.176] CloseHandle (hObject=0x100) returned 1 [0196.176] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39433838384245414243434243324139374230443644393231344333424133375F4542433735373238433631313941373745344441383535394444313046303631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39433838384245414243434243324139374230443644393231344333424133375f4542433735373238433631313941373745344441383535394444313046303631")) returned 0 [0196.177] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\39433838384245414243434243324139374230443644393231344333424133375F4542433735373238433631313941373745344441383535394444313046303631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\39433838384245414243434243324139374230443644393231344333424133375f4542433735373238433631313941373745344441383535394444313046303631")) returned 0x2020 [0196.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 0x325018 [0196.177] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 0 [0196.177] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0196.177] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061")) returned 1 [0196.179] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061")) returned 0xffffffff [0196.179] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0196.179] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0196.179] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.179] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0196.179] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29fac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0196.180] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.180] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29fac) returned 0x10ab [0196.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0196.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\41394534463737363635373334354235323031324345384532373944333134435F3138334135424530423233334343314435313339353546414245434639343530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\41394534463737363635373334354235323031324345384532373944333134435f3138334135424530423233334343314435313339353546414245434639343530"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0196.181] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ae [0196.181] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0196.181] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0196.268] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ae, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1ae, lpOverlapped=0x0) returned 1 [0196.269] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0196.270] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.292] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.304] CloseHandle (hObject=0x100) returned 1 [0196.304] CloseHandle (hObject=0x104) returned 1 [0196.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\41394534463737363635373334354235323031324345384532373944333134435F3138334135424530423233334343314435313339353546414245434639343530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\41394534463737363635373334354235323031324345384532373944333134435f3138334135424530423233334343314435313339353546414245434639343530")) returned 0 [0196.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\41394534463737363635373334354235323031324345384532373944333134435F3138334135424530423233334343314435313339353546414245434639343530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\41394534463737363635373334354235323031324345384532373944333134435f3138334135424530423233334343314435313339353546414245434639343530")) returned 0x2020 [0196.305] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 0x325018 [0196.305] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 0 [0196.305] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0196.305] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450")) returned 1 [0196.306] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450")) returned 0xffffffff [0196.306] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0196.306] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0196.306] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.306] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0196.306] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0196.307] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.307] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0196.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0196.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\41434632343446314131304434444245443044383845424130433433413942355F4241314142364332424446444635373739394538313136453430303244303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\41434632343446314131304434444245443044383845424130433433413942355f4241314142364332424446444635373739394538313136453430303244303031"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0196.308] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ec [0196.308] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0196.308] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0196.403] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ec, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1ec, lpOverlapped=0x0) returned 1 [0196.405] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1f0, lpOverlapped=0x0) returned 1 [0196.406] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.428] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.438] CloseHandle (hObject=0x104) returned 1 [0196.438] CloseHandle (hObject=0x100) returned 1 [0196.439] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\41434632343446314131304434444245443044383845424130433433413942355F4241314142364332424446444635373739394538313136453430303244303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\41434632343446314131304434444245443044383845424130433433413942355f4241314142364332424446444635373739394538313136453430303244303031")) returned 0 [0196.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\41434632343446314131304434444245443044383845424130433433413942355F4241314142364332424446444635373739394538313136453430303244303031" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\41434632343446314131304434444245443044383845424130433433413942355f4241314142364332424446444635373739394538313136453430303244303031")) returned 0x2020 [0196.439] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 0x325018 [0196.439] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 0 [0196.439] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0196.439] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001")) returned 1 [0196.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001")) returned 0xffffffff [0196.440] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0196.441] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0196.441] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.441] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0196.441] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a604, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0196.441] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.441] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a604) returned 0x10ab [0196.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0196.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42334242394331424132443139453039304145333035423236383339303341305F3646304138344345324241393942443139443432433932363130323735383532" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42334242394331424132443139453039304145333035423236383339303341305f3646304138344345324241393942443139443432433932363130323735383532"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0196.442] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a0 [0196.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0196.442] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0196.514] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0196.515] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0196.516] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.538] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.549] CloseHandle (hObject=0x100) returned 1 [0196.549] CloseHandle (hObject=0x104) returned 1 [0196.550] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42334242394331424132443139453039304145333035423236383339303341305F3646304138344345324241393942443139443432433932363130323735383532" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42334242394331424132443139453039304145333035423236383339303341305f3646304138344345324241393942443139443432433932363130323735383532")) returned 0 [0196.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42334242394331424132443139453039304145333035423236383339303341305F3646304138344345324241393942443139443432433932363130323735383532" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42334242394331424132443139453039304145333035423236383339303341305f3646304138344345324241393942443139443432433932363130323735383532")) returned 0x2020 [0196.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 0x325018 [0196.551] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 0 [0196.551] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0196.551] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852")) returned 1 [0196.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852")) returned 0xffffffff [0196.552] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0196.552] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0196.552] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.552] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0196.552] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0196.552] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.552] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0196.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0196.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42334242394331424132443139453039304145333035423236383339303341305F4238394136334143363837374244314544383132343338434538324333454238" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42334242394331424132443139453039304145333035423236383339303341305f4238394136334143363837374244314544383132343338434538324333454238"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0196.553] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a0 [0196.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0196.554] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0196.642] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0196.643] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0196.644] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.667] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.678] CloseHandle (hObject=0x104) returned 1 [0196.678] CloseHandle (hObject=0x100) returned 1 [0196.689] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42334242394331424132443139453039304145333035423236383339303341305F4238394136334143363837374244314544383132343338434538324333454238" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42334242394331424132443139453039304145333035423236383339303341305f4238394136334143363837374244314544383132343338434538324333454238")) returned 0 [0196.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42334242394331424132443139453039304145333035423236383339303341305F4238394136334143363837374244314544383132343338434538324333454238" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42334242394331424132443139453039304145333035423236383339303341305f4238394136334143363837374244314544383132343338434538324333454238")) returned 0x2020 [0196.692] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 0x325018 [0196.692] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 0 [0196.692] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0196.692] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8")) returned 1 [0196.694] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8")) returned 0xffffffff [0196.694] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0196.694] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0196.694] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.695] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0196.695] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29790, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0196.695] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.695] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29790) returned 0x10ab [0196.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0196.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42433537304543304445353833333541464146393246444338453341413333305F3643453645353738423543383438354234424533433444353845313246313530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42433537304543304445353833333541464146393246444338453341413333305f3643453645353738423543383438354234424533433444353845313246313530"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0196.697] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x204 [0196.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0196.697] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0196.794] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x204, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x204, lpOverlapped=0x0) returned 1 [0196.796] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x210, lpOverlapped=0x0) returned 1 [0196.798] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.821] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.832] CloseHandle (hObject=0x100) returned 1 [0196.832] CloseHandle (hObject=0x104) returned 1 [0196.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42433537304543304445353833333541464146393246444338453341413333305F3643453645353738423543383438354234424533433444353845313246313530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42433537304543304445353833333541464146393246444338453341413333305f3643453645353738423543383438354234424533433444353845313246313530")) returned 0 [0196.832] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42433537304543304445353833333541464146393246444338453341413333305F3643453645353738423543383438354234424533433444353845313246313530" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42433537304543304445353833333541464146393246444338453341413333305f3643453645353738423543383438354234424533433444353845313246313530")) returned 0x2020 [0196.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 0x325018 [0196.833] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 0 [0196.833] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0196.833] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150")) returned 1 [0196.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150")) returned 0xffffffff [0196.834] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0196.834] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0196.835] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.835] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0196.835] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0196.835] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.835] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0196.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0196.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42433537304543304445353833333541464146393246444338453341413333305F4634443434394341394530454143434645313539343646384643443334394643" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42433537304543304445353833333541464146393246444338453341413333305f4634443434394341394530454143434645313539343646384643443334394643"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0196.836] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x204 [0196.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0196.836] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0196.928] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x204, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x204, lpOverlapped=0x0) returned 1 [0196.931] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x210, lpOverlapped=0x0) returned 1 [0196.932] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.954] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.965] CloseHandle (hObject=0x104) returned 1 [0196.965] CloseHandle (hObject=0x100) returned 1 [0196.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42433537304543304445353833333541464146393246444338453341413333305F4634443434394341394530454143434645313539343646384643443334394643" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42433537304543304445353833333541464146393246444338453341413333305f4634443434394341394530454143434645313539343646384643443334394643")) returned 0 [0196.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42433537304543304445353833333541464146393246444338453341413333305F4634443434394341394530454143434645313539343646384643443334394643" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\42433537304543304445353833333541464146393246444338453341413333305f4634443434394341394530454143434645313539343646384643443334394643")) returned 0x2020 [0196.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 0x325018 [0196.966] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 0 [0196.966] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0196.967] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc")) returned 1 [0196.967] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc")) returned 0xffffffff [0196.967] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0196.968] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0196.968] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.968] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0196.968] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29de8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0196.968] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0196.968] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29de8) returned 0x10ab [0196.968] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0196.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F3432383230434446454134314443383441414238394136423633353631383733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f3432383230434446454134314443383441414238394136423633353631383733"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0196.969] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192 [0196.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0196.970] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0197.043] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x192, lpOverlapped=0x0) returned 1 [0197.044] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0197.045] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.076] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.087] CloseHandle (hObject=0x100) returned 1 [0197.087] CloseHandle (hObject=0x104) returned 1 [0197.087] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F3432383230434446454134314443383441414238394136423633353631383733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f3432383230434446454134314443383441414238394136423633353631383733")) returned 0 [0197.088] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F3432383230434446454134314443383441414238394136423633353631383733" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f3432383230434446454134314443383441414238394136423633353631383733")) returned 0x2020 [0197.088] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 0x325018 [0197.088] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 0 [0197.089] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0197.089] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873")) returned 1 [0197.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873")) returned 0xffffffff [0197.090] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0197.090] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0197.090] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.090] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0197.090] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0197.090] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.090] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0197.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0197.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F3630343346433630344133393545313438354146374143313644313642374345" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f3630343346433630344133393545313438354146374143313644313642374345"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0197.091] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18e [0197.091] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0197.092] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0197.181] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18e, lpOverlapped=0x0) returned 1 [0197.182] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0197.184] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.206] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.217] CloseHandle (hObject=0x104) returned 1 [0197.217] CloseHandle (hObject=0x100) returned 1 [0197.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F3630343346433630344133393545313438354146374143313644313642374345" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f3630343346433630344133393545313438354146374143313644313642374345")) returned 0 [0197.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F3630343346433630344133393545313438354146374143313644313642374345" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f3630343346433630344133393545313438354146374143313644313642374345")) returned 0x2020 [0197.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 0x325018 [0197.219] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 0 [0197.219] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0197.219] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce")) returned 1 [0197.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce")) returned 0xffffffff [0197.220] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0197.220] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0197.220] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.220] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0197.220] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a440, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0197.220] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.220] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a440) returned 0x10ab [0197.220] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0197.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F4439423946333745434535393542304237423641413132343531443339324346" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f4439423946333745434535393542304237423641413132343531443339324346"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0197.221] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18e [0197.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0197.222] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0197.309] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18e, lpOverlapped=0x0) returned 1 [0197.310] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0197.311] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.334] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.345] CloseHandle (hObject=0x100) returned 1 [0197.345] CloseHandle (hObject=0x104) returned 1 [0197.345] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F4439423946333745434535393542304237423641413132343531443339324346" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f4439423946333745434535393542304237423641413132343531443339324346")) returned 0 [0197.346] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\43343645374230463934323636334131454443384439443644373836393137335F4439423946333745434535393542304237423641413132343531443339324346" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\43343645374230463934323636334131454443384439443644373836393137335f4439423946333745434535393542304237423641413132343531443339324346")) returned 0x2020 [0197.346] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 0x325018 [0197.346] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 0 [0197.346] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0197.346] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf")) returned 1 [0197.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf")) returned 0xffffffff [0197.347] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0197.347] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0197.348] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.348] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0197.348] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0197.348] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.348] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0197.348] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0197.348] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44343744424432463945333336354642424530303844373146423036373136465F3444443130353342434337323644413431313135464646344337443645394343" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44343744424432463945333336354642424530303844373146423036373136465f3444443130353342434337323644413431313135464646344337443645394343"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0197.349] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194 [0197.349] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0197.349] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0197.443] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x194, lpOverlapped=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0197.445] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.467] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.478] CloseHandle (hObject=0x104) returned 1 [0197.478] CloseHandle (hObject=0x100) returned 1 [0197.478] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44343744424432463945333336354642424530303844373146423036373136465F3444443130353342434337323644413431313135464646344337443645394343" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44343744424432463945333336354642424530303844373146423036373136465f3444443130353342434337323644413431313135464646344337443645394343")) returned 0 [0197.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44343744424432463945333336354642424530303844373146423036373136465F3444443130353342434337323644413431313135464646344337443645394343" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44343744424432463945333336354642424530303844373146423036373136465f3444443130353342434337323644413431313135464646344337443645394343")) returned 0x2020 [0197.479] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 0x325018 [0197.479] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 0 [0197.479] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0197.479] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc")) returned 1 [0197.480] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc")) returned 0xffffffff [0197.480] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0197.481] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0197.481] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.481] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0197.481] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29790, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0197.481] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.481] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29790) returned 0x10ab [0197.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0197.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44343744424432463945333336354642424530303844373146423036373136465F4433333139324435384141394341324239303937453834384539464538364445" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44343744424432463945333336354642424530303844373146423036373136465f4433333139324435384141394341324239303937453834384539464538364445"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0197.482] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x198 [0197.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0197.482] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0197.571] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x198, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x198, lpOverlapped=0x0) returned 1 [0197.572] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0197.573] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.644] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.655] CloseHandle (hObject=0x100) returned 1 [0197.655] CloseHandle (hObject=0x104) returned 1 [0197.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44343744424432463945333336354642424530303844373146423036373136465F4433333139324435384141394341324239303937453834384539464538364445" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44343744424432463945333336354642424530303844373146423036373136465f4433333139324435384141394341324239303937453834384539464538364445")) returned 0 [0197.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44343744424432463945333336354642424530303844373146423036373136465F4433333139324435384141394341324239303937453834384539464538364445" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44343744424432463945333336354642424530303844373146423036373136465f4433333139324435384141394341324239303937453834384539464538364445")) returned 0x2020 [0197.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 0x325018 [0197.658] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 0 [0197.658] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0197.658] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de")) returned 1 [0197.659] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de")) returned 0xffffffff [0197.659] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0197.660] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0197.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0197.660] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0197.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0197.660] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0197.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44353243353644384632344245433936363034333732414642414632363445315F4537364132423632374444303139454235314439333335463234423134433243" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44353243353644384632344245433936363034333732414642414632363445315f4537364132423632374444303139454235314439333335463234423134433243"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0197.662] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a4 [0197.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0197.662] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0197.735] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1a4, lpOverlapped=0x0) returned 1 [0197.736] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0197.737] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.760] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.771] CloseHandle (hObject=0x104) returned 1 [0197.771] CloseHandle (hObject=0x100) returned 1 [0197.771] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44353243353644384632344245433936363034333732414642414632363445315F4537364132423632374444303139454235314439333335463234423134433243" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44353243353644384632344245433936363034333732414642414632363445315f4537364132423632374444303139454235314439333335463234423134433243")) returned 0 [0197.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\44353243353644384632344245433936363034333732414642414632363445315F4537364132423632374444303139454235314439333335463234423134433243" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\44353243353644384632344245433936363034333732414642414632363445315f4537364132423632374444303139454235314439333335463234423134433243")) returned 0x2020 [0197.772] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 0x325018 [0197.772] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 0 [0197.772] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0197.772] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c")) returned 1 [0197.773] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c")) returned 0xffffffff [0197.773] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0197.773] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0197.773] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.773] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0197.773] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29de8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0197.773] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.773] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29de8) returned 0x10ab [0197.773] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0197.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\45413631383039374533393334303941464133313646304638374532433230325F3832374331423833373635324230343843344338343233374430383338353835" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\45413631383039374533393334303941464133313646304638374532433230325f3832374331423833373635324230343843344338343233374430383338353835"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0197.775] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18e [0197.775] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0197.776] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0197.865] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18e, lpOverlapped=0x0) returned 1 [0197.866] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x190, lpOverlapped=0x0) returned 1 [0197.867] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.889] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.900] CloseHandle (hObject=0x100) returned 1 [0197.900] CloseHandle (hObject=0x104) returned 1 [0197.900] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\45413631383039374533393334303941464133313646304638374532433230325F3832374331423833373635324230343843344338343233374430383338353835" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\45413631383039374533393334303941464133313646304638374532433230325f3832374331423833373635324230343843344338343233374430383338353835")) returned 0 [0197.901] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\45413631383039374533393334303941464133313646304638374532433230325F3832374331423833373635324230343843344338343233374430383338353835" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\45413631383039374533393334303941464133313646304638374532433230325f3832374331423833373635324230343843344338343233374430383338353835")) returned 0x2020 [0197.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 0x325018 [0197.901] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 0 [0197.901] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0197.901] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585")) returned 1 [0197.902] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585")) returned 0xffffffff [0197.902] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0197.902] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0197.902] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.902] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0197.902] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28420, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0197.902] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0197.903] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28420) returned 0x10ab [0197.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0197.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\46323933414541443545383446414346423638364334413632303731383932385F4338343234413042323441373239333942313337323044304330303043394331" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\46323933414541443545383446414346423638364334413632303731383932385f4338343234413042323441373239333942313337323044304330303043394331"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0197.903] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a0 [0197.904] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0197.904] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0197.992] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0197.993] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0197.994] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.016] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.027] CloseHandle (hObject=0x104) returned 1 [0198.027] CloseHandle (hObject=0x100) returned 1 [0198.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\46323933414541443545383446414346423638364334413632303731383932385F4338343234413042323441373239333942313337323044304330303043394331" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\46323933414541443545383446414346423638364334413632303731383932385f4338343234413042323441373239333942313337323044304330303043394331")) returned 0 [0198.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\46323933414541443545383446414346423638364334413632303731383932385F4338343234413042323441373239333942313337323044304330303043394331" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\46323933414541443545383446414346423638364334413632303731383932385f4338343234413042323441373239333942313337323044304330303043394331")) returned 0x2020 [0198.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 0x325018 [0198.028] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 0 [0198.028] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.028] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1")) returned 1 [0198.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1")) returned 0xffffffff [0198.029] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0198.029] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.029] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.029] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.029] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a42c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.029] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.029] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a42c) returned 0x10ab [0198.029] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f90f18257cbb4d84216ac1e1f3bb2c76"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0198.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4639304631383235374342423444383432313641433145314633424232433736" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4639304631383235374342423444383432313641433145314633424232433736"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0198.030] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc [0198.030] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0198.031] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0198.127] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xfc, lpOverlapped=0x0) returned 1 [0198.128] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x100, lpOverlapped=0x0) returned 1 [0198.129] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.151] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.162] CloseHandle (hObject=0x100) returned 1 [0198.162] CloseHandle (hObject=0x104) returned 1 [0198.162] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f90f18257cbb4d84216ac1e1f3bb2c76"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4639304631383235374342423444383432313641433145314633424232433736" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4639304631383235374342423444383432313641433145314633424232433736")) returned 0 [0198.163] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4639304631383235374342423444383432313641433145314633424232433736" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4639304631383235374342423444383432313641433145314633424232433736")) returned 0x2020 [0198.163] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0x325018 [0198.163] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0198.163] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.163] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f90f18257cbb4d84216ac1e1f3bb2c76")) returned 1 [0198.164] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f90f18257cbb4d84216ac1e1f3bb2c76")) returned 0xffffffff [0198.164] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0198.164] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0198.164] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="MetaData", cAlternateFileName="")) returned 0 [0198.164] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0198.164] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="IME12", cAlternateFileName="")) returned 1 [0198.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0198.165] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0198.166] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0198.166] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0198.166] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0198.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0198.166] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0198.166] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0198.166] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0198.166] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0198.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0198.166] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0198.166] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0198.166] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0198.166] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0198.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0198.167] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0198.167] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0198.167] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0198.167] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0198.167] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0198.168] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0198.168] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0198.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0198.168] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0198.168] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0198.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0198.168] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.168] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0198.169] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.169] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.169] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.169] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28550, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.169] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.169] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28550) returned 0x10ab [0198.169] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0198.170] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\696D6167657372762E61646974696F6E5B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\696d6167657372762e61646974696f6e5b315d.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0198.186] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd [0198.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0198.186] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0198.258] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xd, lpOverlapped=0x0) returned 1 [0198.258] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x10, lpOverlapped=0x0) returned 1 [0198.259] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.281] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.292] CloseHandle (hObject=0x100) returned 1 [0198.292] CloseHandle (hObject=0x108) returned 1 [0198.292] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\696D6167657372762E61646974696F6E5B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\696d6167657372762e61646974696f6e5b315d.xml")) returned 0 [0198.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\696D6167657372762E61646974696F6E5B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\696d6167657372762e61646974696f6e5b315d.xml")) returned 0x2020 [0198.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0x325058 [0198.293] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0198.293] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0198.293] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml")) returned 1 [0198.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml")) returned 0xffffffff [0198.294] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0198.294] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.294] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f697469, dwReserved1=0x5d315b6e, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0198.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x325018 [0198.295] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0198.295] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0198.296] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.296] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.296] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.296] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28b74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.296] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.296] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28b74) returned 0x10ab [0198.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0198.297] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\7777772E676F6F676C655B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\7777772e676f6f676c655b315d.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0198.297] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd [0198.298] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0198.298] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0198.405] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xd, lpOverlapped=0x0) returned 1 [0198.406] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x10, lpOverlapped=0x0) returned 1 [0198.407] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.429] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.439] CloseHandle (hObject=0x108) returned 1 [0198.439] CloseHandle (hObject=0x100) returned 1 [0198.439] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\7777772E676F6F676C655B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\7777772e676f6f676c655b315d.xml")) returned 0 [0198.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\7777772E676F6F676C655B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\7777772e676f6f676c655b315d.xml")) returned 0x2020 [0198.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0x325058 [0198.441] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0198.441] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0198.441] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml")) returned 1 [0198.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml")) returned 0xffffffff [0198.442] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0198.442] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.442] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x782e5d31, dwReserved1=0x5d316c6d, cFileName="index.dat", cAlternateFileName="")) returned 1 [0198.442] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.442] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.442] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.442] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29068, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.442] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.442] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29068) returned 0x10ab [0198.442] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0198.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0198.445] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0198.445] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0198.445] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0198.517] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x8000, lpOverlapped=0x0) returned 1 [0198.519] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x8010, lpOverlapped=0x0) returned 1 [0198.520] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.542] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.553] CloseHandle (hObject=0x104) returned 1 [0198.553] CloseHandle (hObject=0x100) returned 1 [0198.553] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\696e646578.dat")) returned 0 [0198.554] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\696e646578.dat")) returned 0x2020 [0198.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325018 [0198.554] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0198.554] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.554] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat")) returned 1 [0198.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat")) returned 0xffffffff [0198.556] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0198.556] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325018 [0198.556] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0198.556] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 0 [0198.556] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.556] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0198.556] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325018 [0198.556] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0198.556] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xbc00ba, dwReserved1=0x31c7f8, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0198.557] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.557] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.557] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.557] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29468, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.557] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.557] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29468) returned 0x10ab [0198.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0198.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\7777772E6D736E5B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\7777772e6d736e5b315d.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0198.558] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x344 [0198.558] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0198.558] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0198.655] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x344, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x344, lpOverlapped=0x0) returned 1 [0198.657] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x350, lpOverlapped=0x0) returned 1 [0198.658] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.680] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.694] CloseHandle (hObject=0x104) returned 1 [0198.694] CloseHandle (hObject=0x108) returned 1 [0198.696] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\7777772E6D736E5B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\7777772e6d736e5b315d.xml")) returned 0 [0198.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\7777772E6D736E5B315D.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\7777772e6d736e5b315d.xml")) returned 0x2020 [0198.697] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0x325058 [0198.698] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0198.698] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0198.698] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml")) returned 1 [0198.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml")) returned 0xffffffff [0198.699] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xbc00ba, dwReserved1=0x31c7f8, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0198.699] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.699] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0198.699] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0198.699] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Services", cAlternateFileName="")) returned 1 [0198.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x776c6d78, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0198.699] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x776c6d78, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0198.699] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x776c6d78, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 0 [0198.699] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0198.699] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Services", cAlternateFileName="")) returned 0 [0198.699] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0198.699] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0198.700] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0198.700] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x706d7265, cFileName="Sun", cAlternateFileName="")) returned 1 [0198.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0198.701] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="..", cAlternateFileName="")) returned 1 [0198.701] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="Java", cAlternateFileName="")) returned 1 [0198.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0198.702] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0198.702] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="AU", cAlternateFileName="")) returned 1 [0198.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0198.702] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.702] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0198.705] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.707] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.707] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28234, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.708] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.708] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28234) returned 0x10ab [0198.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0198.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\6175.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\6175.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0198.709] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8e062 [0198.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0198.710] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0198.796] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8e062, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x8e062, lpOverlapped=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8e070, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x8e070, lpOverlapped=0x0) returned 1 [0198.821] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.843] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.854] CloseHandle (hObject=0x100) returned 1 [0198.854] CloseHandle (hObject=0x108) returned 1 [0198.854] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\6175.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\6175.cab")) returned 0 [0198.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\6175.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\6175.cab")) returned 0x2020 [0198.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="au.cab", cAlternateFileName="")) returned 0x325018 [0198.855] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="au.cab", cAlternateFileName="")) returned 0 [0198.855] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.855] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab")) returned 1 [0198.860] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab")) returned 0xffffffff [0198.860] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="au.msi", cAlternateFileName="")) returned 1 [0198.860] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.860] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.860] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.860] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c284a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.860] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.860] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c284a4) returned 0x10ab [0198.861] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0198.861] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\6175.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\6175.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0198.862] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d400 [0198.862] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0198.862] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0198.950] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d400, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2d400, lpOverlapped=0x0) returned 1 [0198.956] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d410, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2d410, lpOverlapped=0x0) returned 1 [0198.959] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.981] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.992] CloseHandle (hObject=0x108) returned 1 [0198.992] CloseHandle (hObject=0x100) returned 1 [0198.992] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\6175.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\6175.msi")) returned 0 [0198.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\6175.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\6175.msi")) returned 0x2020 [0198.993] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="au.msi", cAlternateFileName="")) returned 0x325018 [0198.993] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="au.msi", cAlternateFileName="")) returned 0 [0198.993] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.993] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi")) returned 1 [0198.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi")) returned 0xffffffff [0198.995] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="au.msi", cAlternateFileName="")) returned 0 [0198.995] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0198.995] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0198.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0198.996] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0198.996] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0198.996] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.996] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.997] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28554, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28554) returned 0x10ab [0198.997] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="security", cAlternateFileName="")) returned 1 [0198.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName=".", cAlternateFileName="")) returned 0x325018 [0198.998] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="..", cAlternateFileName="")) returned 1 [0198.998] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="..", cAlternateFileName="")) returned 0 [0198.998] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.998] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="tmp", cAlternateFileName="")) returned 1 [0198.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName=".", cAlternateFileName="")) returned 0x325018 [0198.998] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="..", cAlternateFileName="")) returned 1 [0198.998] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="si", cAlternateFileName="")) returned 1 [0198.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0198.998] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.998] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.998] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0198.998] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="si", cAlternateFileName="")) returned 0 [0198.998] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0198.998] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="tmp", cAlternateFileName="")) returned 0 [0198.999] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0198.999] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f7270, dwReserved1=0x69747265, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0198.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0198.999] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 1 [0198.999] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0198.999] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0198.999] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.999] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0198.999] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29a90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0198.999] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0198.999] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29a90) returned 0x10ab [0198.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0199.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\4461746131.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\4461746131.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0199.002] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182ac2a [0199.002] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0199.002] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0199.078] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0199.291] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0199.410] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0199.572] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0199.780] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0199.937] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0200.053] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0200.192] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0200.314] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x42ac2a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x42ac2a, lpOverlapped=0x0) returned 1 [0200.451] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x42ac30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x42ac30, lpOverlapped=0x0) returned 1 [0200.553] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.575] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.589] CloseHandle (hObject=0x100) returned 1 [0200.589] CloseHandle (hObject=0x108) returned 1 [0200.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\4461746131.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\4461746131.cab")) returned 0 [0200.590] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\4461746131.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\4461746131.cab")) returned 0x2020 [0200.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Data1.cab", cAlternateFileName="")) returned 0x325018 [0200.590] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Data1.cab", cAlternateFileName="")) returned 0 [0200.591] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0200.591] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab")) returned 1 [0200.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab")) returned 0xffffffff [0200.595] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1 [0200.596] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0200.596] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0200.597] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0200.597] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c288d0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0200.597] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0200.597] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c288d0) returned 0x10ab [0200.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0200.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\6A7265312E372E305F3435.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\6a7265312e372e305f3435.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0200.600] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd600 [0200.600] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0200.600] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0200.696] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd600, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xdd600, lpOverlapped=0x0) returned 1 [0200.717] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xdd610, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xdd610, lpOverlapped=0x0) returned 1 [0200.733] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.755] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.767] CloseHandle (hObject=0x108) returned 1 [0200.767] CloseHandle (hObject=0x100) returned 1 [0200.767] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\6A7265312E372E305F3435.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\6a7265312e372e305f3435.msi")) returned 0 [0200.768] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\6A7265312E372E305F3435.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\6a7265312e372e305f3435.msi")) returned 0x2020 [0200.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0x325018 [0200.768] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0200.768] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0200.768] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi")) returned 1 [0200.775] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi")) returned 0xffffffff [0200.776] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0200.776] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0200.776] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f7270, dwReserved1=0x69747265, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0200.776] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0200.776] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef73, dwReserved1=0x18ef8c, cFileName="Java", cAlternateFileName="")) returned 0 [0200.776] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0200.776] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x706d7265, cFileName="Sun", cAlternateFileName="")) returned 0 [0200.776] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0200.776] FindNextFileA (in: hFindFile=0x31c7b8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f6ff990, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f6ff990, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 1 [0200.776] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f6ff990, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f6ff990, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x706d7265, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0200.776] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f6ff990, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f6ff990, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x706d7265, cFileName="..", cAlternateFileName="")) returned 1 [0200.776] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x198b6170, ftCreationTime.dwHighDateTime=0x1d5bb6a, ftLastAccessTime.dwLowDateTime=0xe79698f0, ftLastAccessTime.dwHighDateTime=0x1d5b5a7, ftLastWriteTime.dwLowDateTime=0xe79698f0, ftLastWriteTime.dwHighDateTime=0x1d5b5a7, nFileSizeHigh=0x0, nFileSizeLow=0x442f, dwReserved0=0x726f6c70, dwReserved1=0x706d7265, cFileName="-dd5adyHhc6.avi", cAlternateFileName="-DD5AD~1.AVI")) returned 1 [0200.777] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0200.777] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0200.777] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0200.777] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28d10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0200.777] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0200.777] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28d10) returned 0x10ab [0200.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-dd5adyHhc6.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-dd5adyhhc6.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0200.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2D64643561647948686336.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2d64643561647948686336.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0200.778] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x442f [0200.779] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0200.779] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0200.866] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x442f, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x442f, lpOverlapped=0x0) returned 1 [0200.867] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4430, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x4430, lpOverlapped=0x0) returned 1 [0200.868] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.891] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.901] CloseHandle (hObject=0xf8) returned 1 [0200.901] CloseHandle (hObject=0xfc) returned 1 [0200.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-dd5adyHhc6.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-dd5adyhhc6.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2D64643561647948686336.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2d64643561647948686336.avi")) returned 0 [0200.902] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2D64643561647948686336.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2d64643561647948686336.avi")) returned 0x2020 [0200.902] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-dd5adyHhc6.avi", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x198b6170, ftCreationTime.dwHighDateTime=0x1d5bb6a, ftLastAccessTime.dwLowDateTime=0xe79698f0, ftLastAccessTime.dwHighDateTime=0x1d5b5a7, ftLastWriteTime.dwLowDateTime=0xe79698f0, ftLastWriteTime.dwHighDateTime=0x1d5b5a7, nFileSizeHigh=0x0, nFileSizeLow=0x442f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="-dd5adyHhc6.avi", cAlternateFileName="-DD5AD~1.AVI")) returned 0x324f58 [0200.903] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x198b6170, ftCreationTime.dwHighDateTime=0x1d5bb6a, ftLastAccessTime.dwLowDateTime=0xe79698f0, ftLastAccessTime.dwHighDateTime=0x1d5b5a7, ftLastWriteTime.dwLowDateTime=0xe79698f0, ftLastWriteTime.dwHighDateTime=0x1d5b5a7, nFileSizeHigh=0x0, nFileSizeLow=0x442f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="-dd5adyHhc6.avi", cAlternateFileName="-DD5AD~1.AVI")) returned 0 [0200.903] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0200.903] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-dd5adyHhc6.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-dd5adyhhc6.avi")) returned 1 [0200.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-dd5adyHhc6.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-dd5adyhhc6.avi")) returned 0xffffffff [0200.904] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18882ec0, ftCreationTime.dwHighDateTime=0x1d5be8a, ftLastAccessTime.dwLowDateTime=0xe5ea8cc0, ftLastAccessTime.dwHighDateTime=0x1d5be51, ftLastWriteTime.dwLowDateTime=0xe5ea8cc0, ftLastWriteTime.dwHighDateTime=0x1d5be51, nFileSizeHigh=0x0, nFileSizeLow=0xe663, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="2DcktVM.mkv", cAlternateFileName="")) returned 1 [0200.904] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0200.904] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0200.904] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0200.904] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28fec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0200.904] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0200.904] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28fec) returned 0x10ab [0200.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2DcktVM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2dcktvm.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0200.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3244636B74564D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3244636b74564d.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0200.905] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe663 [0200.906] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0200.906] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0200.978] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe663, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xe663, lpOverlapped=0x0) returned 1 [0200.979] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe670, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xe670, lpOverlapped=0x0) returned 1 [0200.981] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.003] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.014] CloseHandle (hObject=0xfc) returned 1 [0201.014] CloseHandle (hObject=0xf8) returned 1 [0201.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2DcktVM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2dcktvm.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3244636B74564D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3244636b74564d.mkv")) returned 0 [0201.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3244636B74564D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3244636b74564d.mkv")) returned 0x2020 [0201.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2DcktVM.mkv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18882ec0, ftCreationTime.dwHighDateTime=0x1d5be8a, ftLastAccessTime.dwLowDateTime=0xe5ea8cc0, ftLastAccessTime.dwHighDateTime=0x1d5be51, ftLastWriteTime.dwLowDateTime=0xe5ea8cc0, ftLastWriteTime.dwHighDateTime=0x1d5be51, nFileSizeHigh=0x0, nFileSizeLow=0xe663, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2DcktVM.mkv", cAlternateFileName="")) returned 0x324f58 [0201.015] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18882ec0, ftCreationTime.dwHighDateTime=0x1d5be8a, ftLastAccessTime.dwLowDateTime=0xe5ea8cc0, ftLastAccessTime.dwHighDateTime=0x1d5be51, ftLastWriteTime.dwLowDateTime=0xe5ea8cc0, ftLastWriteTime.dwHighDateTime=0x1d5be51, nFileSizeHigh=0x0, nFileSizeLow=0xe663, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2DcktVM.mkv", cAlternateFileName="")) returned 0 [0201.015] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0201.015] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2DcktVM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2dcktvm.mkv")) returned 1 [0201.018] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2DcktVM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2dcktvm.mkv")) returned 0xffffffff [0201.018] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62d3cdc0, ftCreationTime.dwHighDateTime=0x1d5b7b1, ftLastAccessTime.dwLowDateTime=0x8048f780, ftLastAccessTime.dwHighDateTime=0x1d5b99c, ftLastWriteTime.dwLowDateTime=0x8048f780, ftLastWriteTime.dwHighDateTime=0x1d5b99c, nFileSizeHigh=0x0, nFileSizeLow=0x690e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2KuvriJyJ0dpOnlOaN3o.bmp", cAlternateFileName="2KUVRI~1.BMP")) returned 1 [0201.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.018] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2929c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2929c) returned 0x10ab [0201.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2KuvriJyJ0dpOnlOaN3o.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2kuvrijyj0dponloan3o.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0201.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\324B757672694A794A3064704F6E6C4F614E336F.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\324b757672694a794a3064704f6e6c4f614e336f.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0201.019] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x690e [0201.019] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0201.019] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0201.108] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x690e, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x690e, lpOverlapped=0x0) returned 1 [0201.109] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6910, lpOverlapped=0x0) returned 1 [0201.110] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.147] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.158] CloseHandle (hObject=0xf8) returned 1 [0201.158] CloseHandle (hObject=0xfc) returned 1 [0201.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2KuvriJyJ0dpOnlOaN3o.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2kuvrijyj0dponloan3o.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\324B757672694A794A3064704F6E6C4F614E336F.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\324b757672694a794a3064704f6e6c4f614e336f.bmp")) returned 0 [0201.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\324B757672694A794A3064704F6E6C4F614E336F.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\324b757672694a794a3064704f6e6c4f614e336f.bmp")) returned 0x2020 [0201.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2KuvriJyJ0dpOnlOaN3o.bmp", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62d3cdc0, ftCreationTime.dwHighDateTime=0x1d5b7b1, ftLastAccessTime.dwLowDateTime=0x8048f780, ftLastAccessTime.dwHighDateTime=0x1d5b99c, ftLastWriteTime.dwLowDateTime=0x8048f780, ftLastWriteTime.dwHighDateTime=0x1d5b99c, nFileSizeHigh=0x0, nFileSizeLow=0x690e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2KuvriJyJ0dpOnlOaN3o.bmp", cAlternateFileName="2KUVRI~1.BMP")) returned 0x324f58 [0201.159] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62d3cdc0, ftCreationTime.dwHighDateTime=0x1d5b7b1, ftLastAccessTime.dwLowDateTime=0x8048f780, ftLastAccessTime.dwHighDateTime=0x1d5b99c, ftLastWriteTime.dwLowDateTime=0x8048f780, ftLastWriteTime.dwHighDateTime=0x1d5b99c, nFileSizeHigh=0x0, nFileSizeLow=0x690e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2KuvriJyJ0dpOnlOaN3o.bmp", cAlternateFileName="2KUVRI~1.BMP")) returned 0 [0201.160] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0201.160] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2KuvriJyJ0dpOnlOaN3o.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2kuvrijyj0dponloan3o.bmp")) returned 1 [0201.161] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2KuvriJyJ0dpOnlOaN3o.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2kuvrijyj0dponloan3o.bmp")) returned 0xffffffff [0201.161] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x277f1ad0, ftCreationTime.dwHighDateTime=0x1d5bc4e, ftLastAccessTime.dwLowDateTime=0xdcf22770, ftLastAccessTime.dwHighDateTime=0x1d5bc5f, ftLastWriteTime.dwLowDateTime=0xdcf22770, ftLastWriteTime.dwHighDateTime=0x1d5bc5f, nFileSizeHigh=0x0, nFileSizeLow=0x13f4d, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="6l-91qpt fGJ.flv", cAlternateFileName="6L-91Q~1.FLV")) returned 1 [0201.162] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.162] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.162] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.162] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29630, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.162] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.162] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29630) returned 0x10ab [0201.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6l-91qpt fGJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6l-91qpt fgj.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0201.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\366C2D39317170742066474A.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\366c2d39317170742066474a.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0201.163] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13f4d [0201.163] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0201.164] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0201.251] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13f4d, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x13f4d, lpOverlapped=0x0) returned 1 [0201.253] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13f50, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x13f50, lpOverlapped=0x0) returned 1 [0201.255] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.277] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.288] CloseHandle (hObject=0xfc) returned 1 [0201.288] CloseHandle (hObject=0xf8) returned 1 [0201.288] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6l-91qpt fGJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6l-91qpt fgj.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\366C2D39317170742066474A.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\366c2d39317170742066474a.flv")) returned 0 [0201.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\366C2D39317170742066474A.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\366c2d39317170742066474a.flv")) returned 0x2020 [0201.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6l-91qpt fGJ.flv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x277f1ad0, ftCreationTime.dwHighDateTime=0x1d5bc4e, ftLastAccessTime.dwLowDateTime=0xdcf22770, ftLastAccessTime.dwHighDateTime=0x1d5bc5f, ftLastWriteTime.dwLowDateTime=0xdcf22770, ftLastWriteTime.dwHighDateTime=0x1d5bc5f, nFileSizeHigh=0x0, nFileSizeLow=0x13f4d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="6l-91qpt fGJ.flv", cAlternateFileName="6L-91Q~1.FLV")) returned 0x324f58 [0201.289] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x277f1ad0, ftCreationTime.dwHighDateTime=0x1d5bc4e, ftLastAccessTime.dwLowDateTime=0xdcf22770, ftLastAccessTime.dwHighDateTime=0x1d5bc5f, ftLastWriteTime.dwLowDateTime=0xdcf22770, ftLastWriteTime.dwHighDateTime=0x1d5bc5f, nFileSizeHigh=0x0, nFileSizeLow=0x13f4d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="6l-91qpt fGJ.flv", cAlternateFileName="6L-91Q~1.FLV")) returned 0 [0201.289] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0201.289] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6l-91qpt fGJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6l-91qpt fgj.flv")) returned 1 [0201.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6l-91qpt fGJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6l-91qpt fgj.flv")) returned 0xffffffff [0201.291] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Adobe", cAlternateFileName="")) returned 1 [0201.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0201.293] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0201.293] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c7f8, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0201.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0201.293] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0201.293] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="10.0", cAlternateFileName="")) returned 1 [0201.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0201.294] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.294] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0201.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0201.294] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.294] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0201.294] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0201.294] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0201.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0201.294] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.294] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0201.294] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0201.295] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0201.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0201.295] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.295] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0201.295] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.296] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.296] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.296] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29b6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.296] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.296] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29b6c) returned 0x10ab [0201.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0201.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\676C6F62.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\676c6f62.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0201.297] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0201.297] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0201.297] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0201.428] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\676C6F62.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\676c6f62.js")) returned 0 [0201.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\676C6F62.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\676c6f62.js")) returned 0x2020 [0201.428] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="glob.js", cAlternateFileName="")) returned 0x325058 [0201.428] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="glob.js", cAlternateFileName="")) returned 0 [0201.429] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0201.429] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 1 [0201.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 0xffffffff [0201.429] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0201.429] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.429] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.429] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.429] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ee0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.429] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.430] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ee0) returned 0x10ab [0201.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0201.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\676C6F622E73657474696E6773.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\676c6f622e73657474696e6773.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0201.432] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa [0201.432] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0201.432] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0201.503] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xa, lpOverlapped=0x0) returned 1 [0201.504] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x10, lpOverlapped=0x0) returned 1 [0201.512] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.534] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.546] CloseHandle (hObject=0x104) returned 1 [0201.546] CloseHandle (hObject=0x108) returned 1 [0201.546] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\676C6F622E73657474696E6773.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\676c6f622e73657474696e6773.js")) returned 0 [0201.547] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\676C6F622E73657474696E6773.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\676c6f622e73657474696e6773.js")) returned 0x2020 [0201.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0x325058 [0201.547] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0201.547] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0201.547] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 1 [0201.548] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 0xffffffff [0201.548] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0201.548] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0201.548] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a2e7367, dwReserved1=0x73, cFileName="Security", cAlternateFileName="")) returned 1 [0201.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName=".", cAlternateFileName="")) returned 0x325018 [0201.548] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="..", cAlternateFileName="")) returned 1 [0201.548] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0201.549] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.549] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.549] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.549] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.549] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.549] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2ac) returned 0x10ab [0201.549] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0201.549] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName=".", cAlternateFileName="")) returned 0x325058 [0201.550] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="..", cAlternateFileName="")) returned 1 [0201.550] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0201.550] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.550] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.550] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.550] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a464, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.550] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.550] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a464) returned 0x10ab [0201.550] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1 [0201.551] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.551] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.551] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.551] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a58c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.551] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.551] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a58c) returned 0x10ab [0201.551] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0 [0201.551] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0201.551] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0201.551] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0201.551] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a2e7367, dwReserved1=0x73, cFileName="Security", cAlternateFileName="")) returned 0 [0201.551] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0201.551] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="10.0", cAlternateFileName="")) returned 0 [0201.551] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0201.551] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c7f8, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0201.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0201.552] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0201.552] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0201.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0201.552] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 1 [0201.552] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0201.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0201.553] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.553] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0201.553] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0201.553] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0201.553] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0201.553] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0201.553] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0201.554] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c7f8, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0201.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0201.554] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0201.554] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 0 [0201.554] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0201.554] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x31c7f8, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0201.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0201.554] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0201.554] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0201.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0201.554] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 1 [0201.554] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 0 [0201.554] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0201.554] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0201.555] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0201.555] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0073, dwReserved1=0x31c7f8, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0201.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0201.555] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0201.555] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 0 [0201.555] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0201.555] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0073, dwReserved1=0x31c7f8, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0201.555] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0201.555] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9cc220, ftCreationTime.dwHighDateTime=0x1d5c2ff, ftLastAccessTime.dwLowDateTime=0xc15d5a00, ftLastAccessTime.dwHighDateTime=0x1d5bd33, ftLastWriteTime.dwLowDateTime=0xc15d5a00, ftLastWriteTime.dwHighDateTime=0x1d5bd33, nFileSizeHigh=0x0, nFileSizeLow=0x1233e, dwReserved0=0x77353274, dwReserved1=0x7758a963, cFileName="b9zYEuV.mp4", cAlternateFileName="")) returned 1 [0201.555] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.555] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.555] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.555] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a628, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.555] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.555] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a628) returned 0x10ab [0201.556] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa57cdbc0, ftCreationTime.dwHighDateTime=0x1d5c595, ftLastAccessTime.dwLowDateTime=0xf73647e0, ftLastAccessTime.dwHighDateTime=0x1d5bdce, ftLastWriteTime.dwLowDateTime=0xf73647e0, ftLastWriteTime.dwHighDateTime=0x1d5bdce, nFileSizeHigh=0x0, nFileSizeLow=0x9c8f, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="bwaqOk.m4a", cAlternateFileName="")) returned 1 [0201.556] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.556] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.556] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.556] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a6c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.556] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.556] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a6c4) returned 0x10ab [0201.556] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ffc9e60, ftCreationTime.dwHighDateTime=0x1d5c447, ftLastAccessTime.dwLowDateTime=0x1f41a0, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0x1f41a0, ftLastWriteTime.dwHighDateTime=0x1d5c558, nFileSizeHigh=0x0, nFileSizeLow=0x1510b, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="cKZlsqaYbRP4R.rtf", cAlternateFileName="CKZLSQ~1.RTF")) returned 1 [0201.556] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.556] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.556] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.556] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a774, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.556] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.556] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a774) returned 0x10ab [0201.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cKZlsqaYbRP4R.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ckzlsqaybrp4r.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0201.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\634B5A6C737161596252503452.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\634b5a6c737161596252503452.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0201.558] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1510b [0201.558] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0201.558] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0201.666] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1510b, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x1510b, lpOverlapped=0x0) returned 1 [0201.668] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x15110, lpOverlapped=0x0) returned 1 [0201.671] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.693] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.710] CloseHandle (hObject=0xf8) returned 1 [0201.710] CloseHandle (hObject=0xfc) returned 1 [0201.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cKZlsqaYbRP4R.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ckzlsqaybrp4r.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\634B5A6C737161596252503452.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\634b5a6c737161596252503452.rtf")) returned 0 [0201.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\634B5A6C737161596252503452.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\634b5a6c737161596252503452.rtf")) returned 0x2020 [0201.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cKZlsqaYbRP4R.rtf", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ffc9e60, ftCreationTime.dwHighDateTime=0x1d5c447, ftLastAccessTime.dwLowDateTime=0x1f41a0, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0x1f41a0, ftLastWriteTime.dwHighDateTime=0x1d5c558, nFileSizeHigh=0x0, nFileSizeLow=0x1510b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cKZlsqaYbRP4R.rtf", cAlternateFileName="CKZLSQ~1.RTF")) returned 0x324f58 [0201.711] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ffc9e60, ftCreationTime.dwHighDateTime=0x1d5c447, ftLastAccessTime.dwLowDateTime=0x1f41a0, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0x1f41a0, ftLastWriteTime.dwHighDateTime=0x1d5c558, nFileSizeHigh=0x0, nFileSizeLow=0x1510b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cKZlsqaYbRP4R.rtf", cAlternateFileName="CKZLSQ~1.RTF")) returned 0 [0201.711] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0201.711] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cKZlsqaYbRP4R.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ckzlsqaybrp4r.rtf")) returned 1 [0201.713] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cKZlsqaYbRP4R.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ckzlsqaybrp4r.rtf")) returned 0xffffffff [0201.713] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb55fd160, ftCreationTime.dwHighDateTime=0x1d5c50d, ftLastAccessTime.dwLowDateTime=0xdcc3140, ftLastAccessTime.dwHighDateTime=0x1d5b6d6, ftLastWriteTime.dwLowDateTime=0xdcc3140, ftLastWriteTime.dwHighDateTime=0x1d5b6d6, nFileSizeHigh=0x0, nFileSizeLow=0x1693b, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="cWxn.mp4", cAlternateFileName="")) returned 1 [0201.713] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.714] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a9c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a9c4) returned 0x10ab [0201.714] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a1b1340, ftCreationTime.dwHighDateTime=0x1d5c050, ftLastAccessTime.dwLowDateTime=0x744dd420, ftLastAccessTime.dwHighDateTime=0x1d5c15b, ftLastWriteTime.dwLowDateTime=0x744dd420, ftLastWriteTime.dwHighDateTime=0x1d5c15b, nFileSizeHigh=0x0, nFileSizeLow=0xc1a4, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="DO95fYF7iQNFBkSS.mp4", cAlternateFileName="DO95FY~1.MP4")) returned 1 [0201.714] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.714] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa08) returned 0x10ab [0201.714] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcad477d0, ftCreationTime.dwHighDateTime=0x1d5c55d, ftLastAccessTime.dwLowDateTime=0x8dee9b30, ftLastAccessTime.dwHighDateTime=0x1d5bb20, ftLastWriteTime.dwLowDateTime=0x8dee9b30, ftLastWriteTime.dwHighDateTime=0x1d5bb20, nFileSizeHigh=0x0, nFileSizeLow=0x1343d, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="eE1dl Ox8VHRTQ.bmp", cAlternateFileName="EE1DLO~1.BMP")) returned 1 [0201.715] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.715] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.715] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.715] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aab8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.715] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.715] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aab8) returned 0x10ab [0201.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eE1dl Ox8VHRTQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ee1dl ox8vhrtq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0201.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\654531646C204F78385648525451.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\654531646c204f78385648525451.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0201.716] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1343d [0201.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0201.716] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0201.806] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1343d, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x1343d, lpOverlapped=0x0) returned 1 [0201.808] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13440, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x13440, lpOverlapped=0x0) returned 1 [0201.810] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.833] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.844] CloseHandle (hObject=0xfc) returned 1 [0201.844] CloseHandle (hObject=0xf8) returned 1 [0201.844] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eE1dl Ox8VHRTQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ee1dl ox8vhrtq.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\654531646C204F78385648525451.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\654531646c204f78385648525451.bmp")) returned 0 [0201.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\654531646C204F78385648525451.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\654531646c204f78385648525451.bmp")) returned 0x2020 [0201.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eE1dl Ox8VHRTQ.bmp", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcad477d0, ftCreationTime.dwHighDateTime=0x1d5c55d, ftLastAccessTime.dwLowDateTime=0x8dee9b30, ftLastAccessTime.dwHighDateTime=0x1d5bb20, ftLastWriteTime.dwLowDateTime=0x8dee9b30, ftLastWriteTime.dwHighDateTime=0x1d5bb20, nFileSizeHigh=0x0, nFileSizeLow=0x1343d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="eE1dl Ox8VHRTQ.bmp", cAlternateFileName="EE1DLO~1.BMP")) returned 0x324f58 [0201.845] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcad477d0, ftCreationTime.dwHighDateTime=0x1d5c55d, ftLastAccessTime.dwLowDateTime=0x8dee9b30, ftLastAccessTime.dwHighDateTime=0x1d5bb20, ftLastWriteTime.dwLowDateTime=0x8dee9b30, ftLastWriteTime.dwHighDateTime=0x1d5bb20, nFileSizeHigh=0x0, nFileSizeLow=0x1343d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="eE1dl Ox8VHRTQ.bmp", cAlternateFileName="EE1DLO~1.BMP")) returned 0 [0201.845] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0201.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eE1dl Ox8VHRTQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ee1dl ox8vhrtq.bmp")) returned 1 [0201.847] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eE1dl Ox8VHRTQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ee1dl ox8vhrtq.bmp")) returned 0xffffffff [0201.847] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7932650, ftCreationTime.dwHighDateTime=0x1d5b6ce, ftLastAccessTime.dwLowDateTime=0xb00c1b0, ftLastAccessTime.dwHighDateTime=0x1d5b9f6, ftLastWriteTime.dwLowDateTime=0xb00c1b0, ftLastWriteTime.dwHighDateTime=0x1d5b9f6, nFileSizeHigh=0x0, nFileSizeLow=0x101d9, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="El8GD-oph.jpg", cAlternateFileName="EL8GD-~1.JPG")) returned 1 [0201.848] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.848] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.848] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.848] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae18, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.848] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.848] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae18) returned 0x10ab [0201.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\El8GD-oph.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\el8gd-oph.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0201.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\456C3847442D6F7068.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\456c3847442d6f7068.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0201.849] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101d9 [0201.849] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0201.849] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0201.939] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x101d9, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x101d9, lpOverlapped=0x0) returned 1 [0201.942] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x101e0, lpOverlapped=0x0) returned 1 [0201.944] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.967] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.978] CloseHandle (hObject=0xf8) returned 1 [0201.978] CloseHandle (hObject=0xfc) returned 1 [0201.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\El8GD-oph.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\el8gd-oph.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\456C3847442D6F7068.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\456c3847442d6f7068.jpg")) returned 0 [0201.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\456C3847442D6F7068.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\456c3847442d6f7068.jpg")) returned 0x2020 [0201.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\El8GD-oph.jpg", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7932650, ftCreationTime.dwHighDateTime=0x1d5b6ce, ftLastAccessTime.dwLowDateTime=0xb00c1b0, ftLastAccessTime.dwHighDateTime=0x1d5b9f6, ftLastWriteTime.dwLowDateTime=0xb00c1b0, ftLastWriteTime.dwHighDateTime=0x1d5b9f6, nFileSizeHigh=0x0, nFileSizeLow=0x101d9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="El8GD-oph.jpg", cAlternateFileName="EL8GD-~1.JPG")) returned 0x324f58 [0201.979] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7932650, ftCreationTime.dwHighDateTime=0x1d5b6ce, ftLastAccessTime.dwLowDateTime=0xb00c1b0, ftLastAccessTime.dwHighDateTime=0x1d5b9f6, ftLastWriteTime.dwLowDateTime=0xb00c1b0, ftLastWriteTime.dwHighDateTime=0x1d5b9f6, nFileSizeHigh=0x0, nFileSizeLow=0x101d9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="El8GD-oph.jpg", cAlternateFileName="EL8GD-~1.JPG")) returned 0 [0201.979] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0201.979] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\El8GD-oph.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\el8gd-oph.jpg")) returned 1 [0201.981] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\El8GD-oph.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\el8gd-oph.jpg")) returned 0xffffffff [0201.981] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e82650, ftCreationTime.dwHighDateTime=0x1d5c5ad, ftLastAccessTime.dwLowDateTime=0x171f76a0, ftLastAccessTime.dwHighDateTime=0x1d5c593, ftLastWriteTime.dwLowDateTime=0x171f76a0, ftLastWriteTime.dwHighDateTime=0x1d5c593, nFileSizeHigh=0x0, nFileSizeLow=0x14eab, dwReserved0=0x0, dwReserved1=0x0, cFileName="fuOCQ4Pp.wav", cAlternateFileName="")) returned 1 [0201.982] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0201.982] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.982] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0201.982] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29bb0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0201.982] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0201.982] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29bb0) returned 0x10ab [0201.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fuOCQ4Pp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fuocq4pp.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0201.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\66754F4351345070.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\66754f4351345070.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0201.983] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14eab [0201.983] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0201.983] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0202.056] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14eab, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x14eab, lpOverlapped=0x0) returned 1 [0202.058] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14eb0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x14eb0, lpOverlapped=0x0) returned 1 [0202.060] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.083] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.095] CloseHandle (hObject=0xfc) returned 1 [0202.095] CloseHandle (hObject=0xf8) returned 1 [0202.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fuOCQ4Pp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fuocq4pp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\66754F4351345070.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\66754f4351345070.wav")) returned 0 [0202.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\66754F4351345070.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\66754f4351345070.wav")) returned 0x2020 [0202.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fuOCQ4Pp.wav", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e82650, ftCreationTime.dwHighDateTime=0x1d5c5ad, ftLastAccessTime.dwLowDateTime=0x171f76a0, ftLastAccessTime.dwHighDateTime=0x1d5c593, ftLastWriteTime.dwLowDateTime=0x171f76a0, ftLastWriteTime.dwHighDateTime=0x1d5c593, nFileSizeHigh=0x0, nFileSizeLow=0x14eab, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fuOCQ4Pp.wav", cAlternateFileName="")) returned 0x324f58 [0202.096] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e82650, ftCreationTime.dwHighDateTime=0x1d5c5ad, ftLastAccessTime.dwLowDateTime=0x171f76a0, ftLastAccessTime.dwHighDateTime=0x1d5c593, ftLastWriteTime.dwLowDateTime=0x171f76a0, ftLastWriteTime.dwHighDateTime=0x1d5c593, nFileSizeHigh=0x0, nFileSizeLow=0x14eab, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fuOCQ4Pp.wav", cAlternateFileName="")) returned 0 [0202.096] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0202.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fuOCQ4Pp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fuocq4pp.wav")) returned 1 [0202.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fuOCQ4Pp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fuocq4pp.wav")) returned 0xffffffff [0202.109] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe017c1e0, ftCreationTime.dwHighDateTime=0x1d5bc95, ftLastAccessTime.dwLowDateTime=0x860b39d0, ftLastAccessTime.dwHighDateTime=0x1d5b735, ftLastWriteTime.dwLowDateTime=0x860b39d0, ftLastWriteTime.dwHighDateTime=0x1d5b735, nFileSizeHigh=0x0, nFileSizeLow=0x8c1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="i _BHfqlGXEWKND.m4a", cAlternateFileName="I_BHFQ~1.M4A")) returned 1 [0202.110] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.110] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29e78, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29e78) returned 0x10ab [0202.110] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e137850, ftCreationTime.dwHighDateTime=0x1d5c483, ftLastAccessTime.dwLowDateTime=0x5e496690, ftLastAccessTime.dwHighDateTime=0x1d5bfa7, ftLastWriteTime.dwLowDateTime=0x5e496690, ftLastWriteTime.dwHighDateTime=0x1d5bfa7, nFileSizeHigh=0x0, nFileSizeLow=0xda2a, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="IAdB.gif", cAlternateFileName="")) returned 1 [0202.110] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.110] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.110] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.110] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f0c) returned 0x10ab [0202.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IAdB.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iadb.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0202.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\49416442.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\49416442.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0202.112] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda2a [0202.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0202.112] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0202.211] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xda2a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xda2a, lpOverlapped=0x0) returned 1 [0202.212] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xda30, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xda30, lpOverlapped=0x0) returned 1 [0202.214] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.237] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.248] CloseHandle (hObject=0xf8) returned 1 [0202.248] CloseHandle (hObject=0xfc) returned 1 [0202.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IAdB.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iadb.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\49416442.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\49416442.gif")) returned 0 [0202.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\49416442.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\49416442.gif")) returned 0x2020 [0202.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IAdB.gif", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e137850, ftCreationTime.dwHighDateTime=0x1d5c483, ftLastAccessTime.dwLowDateTime=0x5e496690, ftLastAccessTime.dwHighDateTime=0x1d5bfa7, ftLastWriteTime.dwLowDateTime=0x5e496690, ftLastWriteTime.dwHighDateTime=0x1d5bfa7, nFileSizeHigh=0x0, nFileSizeLow=0xda2a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="IAdB.gif", cAlternateFileName="")) returned 0x324f58 [0202.249] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e137850, ftCreationTime.dwHighDateTime=0x1d5c483, ftLastAccessTime.dwLowDateTime=0x5e496690, ftLastAccessTime.dwHighDateTime=0x1d5bfa7, ftLastWriteTime.dwLowDateTime=0x5e496690, ftLastWriteTime.dwHighDateTime=0x1d5bfa7, nFileSizeHigh=0x0, nFileSizeLow=0xda2a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="IAdB.gif", cAlternateFileName="")) returned 0 [0202.249] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0202.250] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IAdB.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iadb.gif")) returned 1 [0202.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IAdB.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iadb.gif")) returned 0xffffffff [0202.251] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0202.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e006c, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0202.252] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e006c, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0202.252] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e006c, dwReserved1=0x31c7f8, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0202.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.252] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0202.252] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 0 [0202.252] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.252] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e006c, dwReserved1=0x31c7f8, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0202.252] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0202.252] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4a68c0e0, ftCreationTime.dwHighDateTime=0x1d5bf47, ftLastAccessTime.dwLowDateTime=0x846f28e0, ftLastAccessTime.dwHighDateTime=0x1d5b7ec, ftLastWriteTime.dwLowDateTime=0x846f28e0, ftLastWriteTime.dwHighDateTime=0x1d5b7ec, nFileSizeHigh=0x0, nFileSizeLow=0x6887, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="kuz b8wC.m4a", cAlternateFileName="KUZB8W~1.M4A")) returned 1 [0202.253] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.253] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28bec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28bec) returned 0x10ab [0202.253] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3abbfe20, ftCreationTime.dwHighDateTime=0x1d5b987, ftLastAccessTime.dwLowDateTime=0xbaf95710, ftLastAccessTime.dwHighDateTime=0x1d5b813, ftLastWriteTime.dwLowDateTime=0xbaf95710, ftLastWriteTime.dwHighDateTime=0x1d5b813, nFileSizeHigh=0x0, nFileSizeLow=0x3b6a, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="L86hkcM.mkv", cAlternateFileName="")) returned 1 [0202.253] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.253] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a1c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a1c4) returned 0x10ab [0202.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\L86hkcM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\l86hkcm.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0202.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4C3836686B634D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4c3836686b634d.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0202.255] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b6a [0202.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0202.255] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0202.345] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3b6a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x3b6a, lpOverlapped=0x0) returned 1 [0202.346] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3b70, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x3b70, lpOverlapped=0x0) returned 1 [0202.347] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.370] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.381] CloseHandle (hObject=0xfc) returned 1 [0202.381] CloseHandle (hObject=0xf8) returned 1 [0202.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\L86hkcM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\l86hkcm.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4C3836686B634D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4c3836686b634d.mkv")) returned 0 [0202.382] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4C3836686B634D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4c3836686b634d.mkv")) returned 0x2020 [0202.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\L86hkcM.mkv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3abbfe20, ftCreationTime.dwHighDateTime=0x1d5b987, ftLastAccessTime.dwLowDateTime=0xbaf95710, ftLastAccessTime.dwHighDateTime=0x1d5b813, ftLastWriteTime.dwLowDateTime=0xbaf95710, ftLastWriteTime.dwHighDateTime=0x1d5b813, nFileSizeHigh=0x0, nFileSizeLow=0x3b6a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="L86hkcM.mkv", cAlternateFileName="")) returned 0x324f58 [0202.382] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3abbfe20, ftCreationTime.dwHighDateTime=0x1d5b987, ftLastAccessTime.dwLowDateTime=0xbaf95710, ftLastAccessTime.dwHighDateTime=0x1d5b813, ftLastWriteTime.dwLowDateTime=0xbaf95710, ftLastWriteTime.dwHighDateTime=0x1d5b813, nFileSizeHigh=0x0, nFileSizeLow=0x3b6a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="L86hkcM.mkv", cAlternateFileName="")) returned 0 [0202.382] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0202.382] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\L86hkcM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\l86hkcm.mkv")) returned 1 [0202.384] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\L86hkcM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\l86hkcm.mkv")) returned 0xffffffff [0202.384] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x629dd350, ftCreationTime.dwHighDateTime=0x1d5c4db, ftLastAccessTime.dwLowDateTime=0xafa9c420, ftLastAccessTime.dwHighDateTime=0x1d5bcec, ftLastWriteTime.dwLowDateTime=0xafa9c420, ftLastWriteTime.dwHighDateTime=0x1d5bcec, nFileSizeHigh=0x0, nFileSizeLow=0xc8e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="m69E8_h.mp3", cAlternateFileName="")) returned 1 [0202.385] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.385] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.385] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.385] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28f58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.385] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.385] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28f58) returned 0x10ab [0202.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\m69E8_h.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m69e8_h.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0202.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6D363945385F68.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6d363945385f68.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0202.386] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8e3 [0202.386] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0202.386] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0202.471] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc8e3, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xc8e3, lpOverlapped=0x0) returned 1 [0202.473] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc8f0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xc8f0, lpOverlapped=0x0) returned 1 [0202.475] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.497] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.508] CloseHandle (hObject=0xf8) returned 1 [0202.508] CloseHandle (hObject=0xfc) returned 1 [0202.508] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\m69E8_h.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m69e8_h.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6D363945385F68.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6d363945385f68.mp3")) returned 0 [0202.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6D363945385F68.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6d363945385f68.mp3")) returned 0x2020 [0202.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\m69E8_h.mp3", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x629dd350, ftCreationTime.dwHighDateTime=0x1d5c4db, ftLastAccessTime.dwLowDateTime=0xafa9c420, ftLastAccessTime.dwHighDateTime=0x1d5bcec, ftLastWriteTime.dwLowDateTime=0xafa9c420, ftLastWriteTime.dwHighDateTime=0x1d5bcec, nFileSizeHigh=0x0, nFileSizeLow=0xc8e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="m69E8_h.mp3", cAlternateFileName="")) returned 0x324f58 [0202.509] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x629dd350, ftCreationTime.dwHighDateTime=0x1d5c4db, ftLastAccessTime.dwLowDateTime=0xafa9c420, ftLastAccessTime.dwHighDateTime=0x1d5bcec, ftLastWriteTime.dwLowDateTime=0xafa9c420, ftLastWriteTime.dwHighDateTime=0x1d5bcec, nFileSizeHigh=0x0, nFileSizeLow=0xc8e3, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="m69E8_h.mp3", cAlternateFileName="")) returned 0 [0202.509] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0202.509] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\m69E8_h.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m69e8_h.mp3")) returned 1 [0202.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\m69E8_h.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m69e8_h.mp3")) returned 0xffffffff [0202.510] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0202.511] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740072, dwReserved1=0x30f830, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0202.511] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740072, dwReserved1=0x30f830, cFileName="..", cAlternateFileName="")) returned 1 [0202.511] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740072, dwReserved1=0x30f830, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0202.511] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.512] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0202.512] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0202.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0202.516] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.516] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0202.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0202.517] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.517] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0202.517] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0202.517] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0202.517] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0202.517] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0202.517] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0202.518] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.518] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0202.518] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0202.518] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.518] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0202.518] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0202.519] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.519] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1 [0202.519] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325098 [0202.519] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.519] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0202.520] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.520] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.520] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.520] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a828, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.520] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.520] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a828) returned 0x10ab [0202.520] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0202.520] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0202.520] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 0 [0202.520] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0202.520] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0202.520] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0202.520] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0202.520] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0202.520] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0202.520] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.520] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740072, dwReserved1=0x30f830, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0202.521] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0202.521] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0202.521] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0202.521] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="..", cAlternateFileName="")) returned 1 [0202.521] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="AddIns", cAlternateFileName="")) returned 1 [0202.521] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.522] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0202.522] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 0 [0202.522] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.522] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0202.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.522] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0202.522] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 0 [0202.522] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.522] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="Crypto", cAlternateFileName="")) returned 1 [0202.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.523] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0202.523] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="RSA", cAlternateFileName="")) returned 1 [0202.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0202.523] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.523] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0202.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0202.524] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.525] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0202.525] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.525] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291f8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291f8) returned 0x10ab [0202.525] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0202.526] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\38336161346363373766353931646663323337343538306262643935663662615F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\38336161346363373766353931646663323337343538306262643935663662615f30333033643562342d666665392d343730652d396464382d376439656334313665353366"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0202.527] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d [0202.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0202.527] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0202.616] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x2d, lpOverlapped=0x0) returned 1 [0202.617] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x30, lpOverlapped=0x0) returned 1 [0202.618] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.640] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.650] CloseHandle (hObject=0x108) returned 1 [0202.651] CloseHandle (hObject=0x104) returned 1 [0202.651] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\38336161346363373766353931646663323337343538306262643935663662615F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\38336161346363373766353931646663323337343538306262643935663662615f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0 [0202.652] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\38336161346363373766353931646663323337343538306262643935663662615F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\38336161346363373766353931646663323337343538306262643935663662615f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0x2020 [0202.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 0x325058 [0202.652] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 0 [0202.652] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0202.652] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 1 [0202.653] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0xffffffff [0202.653] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1 [0202.654] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.654] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.654] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.654] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac54, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.654] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.654] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac54) returned 0x10ab [0202.654] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0202.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\39333261326462353863323337616264333831643232646634633633613034615F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\39333261326462353863323337616264333831643232646634633633613034615f30333033643562342d666665392d343730652d396464382d376439656334313665353366"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0202.655] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x57 [0202.655] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0202.656] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0202.744] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x57, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x57, lpOverlapped=0x0) returned 1 [0202.745] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x60, lpOverlapped=0x0) returned 1 [0202.745] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.768] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.780] CloseHandle (hObject=0x104) returned 1 [0202.780] CloseHandle (hObject=0x108) returned 1 [0202.780] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\39333261326462353863323337616264333831643232646634633633613034615F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\39333261326462353863323337616264333831643232646634633633613034615f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0 [0202.781] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\39333261326462353863323337616264333831643232646634633633613034615F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\39333261326462353863323337616264333831643232646634633633613034615f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0x2020 [0202.781] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 0x325058 [0202.781] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 0 [0202.781] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0202.781] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 1 [0202.782] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0xffffffff [0202.782] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1 [0202.783] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.783] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.783] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.783] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0202.783] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.783] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.783] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0202.783] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0202.784] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0202.784] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66646139393263386435363466393765343834313061313961326534353966365F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66646139393263386435363466393765343834313061313961326534353966365f30333033643562342d666665392d343730652d396464382d376439656334313665353366"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0202.784] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d [0202.785] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0202.785] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0202.858] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x3d, lpOverlapped=0x0) returned 1 [0202.859] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x40, lpOverlapped=0x0) returned 1 [0202.860] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.881] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.893] CloseHandle (hObject=0x108) returned 1 [0202.893] CloseHandle (hObject=0x104) returned 1 [0202.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66646139393263386435363466393765343834313061313961326534353966365F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66646139393263386435363466393765343834313061313961326534353966365f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0 [0202.894] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66646139393263386435363466393765343834313061313961326534353966365F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66646139393263386435363466393765343834313061313961326534353966365f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0x2020 [0202.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0x325058 [0202.894] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0 [0202.894] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0202.894] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 1 [0202.895] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0xffffffff [0202.895] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0 [0202.895] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0202.895] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0202.895] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0202.895] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="RSA", cAlternateFileName="")) returned 0 [0202.895] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.895] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0202.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.896] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0202.896] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="1033", cAlternateFileName="")) returned 1 [0202.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0202.896] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="..", cAlternateFileName="")) returned 1 [0202.896] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="14", cAlternateFileName="")) returned 1 [0202.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0202.896] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.896] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0202.897] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.897] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.897] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.897] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295d8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.897] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.897] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295d8) returned 0x10ab [0202.897] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0202.897] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0202.897] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="14", cAlternateFileName="")) returned 0 [0202.897] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0202.897] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="1033", cAlternateFileName="")) returned 0 [0202.897] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.900] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="Excel", cAlternateFileName="")) returned 1 [0202.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.900] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0202.900] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0202.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0202.901] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 1 [0202.901] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 0 [0202.901] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0202.901] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0202.901] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.901] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="IME12", cAlternateFileName="")) returned 1 [0202.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.901] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0202.901] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0202.902] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.902] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0202.902] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.902] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0202.902] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0202.902] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.902] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0202.902] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.902] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0202.902] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0202.903] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.903] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0202.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.903] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0202.903] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0202.903] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0202.903] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x30f830, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0202.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0202.903] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0202.903] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0202.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0202.903] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 1 [0202.904] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0202.904] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0202.904] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.904] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0202.904] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ac8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0202.904] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0202.904] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ac8) returned 0x10ab [0202.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0202.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0202.905] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0202.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0202.906] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0202.992] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xdd, lpOverlapped=0x0) returned 1 [0202.993] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xe0, lpOverlapped=0x0) returned 1 [0202.994] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.016] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.027] CloseHandle (hObject=0x100) returned 1 [0203.027] CloseHandle (hObject=0x104) returned 1 [0203.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\6465736b746f70.ini")) returned 0 [0203.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\6465736b746f70.ini")) returned 0x20 [0203.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0203.028] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0203.028] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0203.028] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1 [0203.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0xffffffff [0203.029] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0203.030] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0203.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0203.030] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29c58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0203.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29c58) returned 0x10ab [0203.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0203.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\476F6F676C65204368726F6D65.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\476f6f676c65204368726f6d65.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0203.031] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8e9 [0203.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0203.032] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0203.127] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8e9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x8e9, lpOverlapped=0x0) returned 1 [0203.130] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x8f0, lpOverlapped=0x0) returned 1 [0203.131] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.164] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.175] CloseHandle (hObject=0x104) returned 1 [0203.175] CloseHandle (hObject=0x100) returned 1 [0203.175] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\476F6F676C65204368726F6D65.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\476f6f676c65204368726f6d65.lnk")) returned 0 [0203.177] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\476F6F676C65204368726F6D65.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\476f6f676c65204368726f6d65.lnk")) returned 0x20 [0203.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x325018 [0203.177] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0 [0203.177] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0203.177] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 1 [0203.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 0xffffffff [0203.178] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1 [0203.179] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0203.179] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.180] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0203.180] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0203.180] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.180] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a060) returned 0x10ab [0203.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0203.181] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\4C61756E636820496E7465726E6574204578706C6F7265722042726F77736572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\4c61756e636820496e7465726e6574204578706c6f7265722042726f77736572.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0203.182] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a7 [0203.182] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0203.182] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0203.270] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5a7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5a7, lpOverlapped=0x0) returned 1 [0203.273] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5b0, lpOverlapped=0x0) returned 1 [0203.274] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.297] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.307] CloseHandle (hObject=0x100) returned 1 [0203.307] CloseHandle (hObject=0x104) returned 1 [0203.307] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\4C61756E636820496E7465726E6574204578706C6F7265722042726F77736572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\4c61756e636820496e7465726e6574204578706c6f7265722042726f77736572.lnk")) returned 0 [0203.308] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\4C61756E636820496E7465726E6574204578706C6F7265722042726F77736572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\4c61756e636820496e7465726e6574204578706c6f7265722042726f77736572.lnk")) returned 0x20 [0203.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 0x325018 [0203.309] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 0 [0203.309] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0203.309] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 1 [0203.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 0xffffffff [0203.310] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0203.310] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0203.310] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.310] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0203.310] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a630, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0203.310] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.310] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a630) returned 0x10ab [0203.310] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0203.311] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\53686F7773204465736B746F70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\53686f7773204465736b746f70.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0203.312] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122 [0203.312] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0203.312] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0203.419] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x122, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x122, lpOverlapped=0x0) returned 1 [0203.419] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x130, lpOverlapped=0x0) returned 1 [0203.420] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.443] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.454] CloseHandle (hObject=0x104) returned 1 [0203.454] CloseHandle (hObject=0x100) returned 1 [0203.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\53686F7773204465736B746F70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\53686f7773204465736b746f70.lnk")) returned 0 [0203.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\53686F7773204465736B746F70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\53686f7773204465736b746f70.lnk")) returned 0x20 [0203.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0x325018 [0203.455] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0 [0203.455] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0203.455] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0203.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0xffffffff [0203.456] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0203.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd200d0, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325018 [0203.456] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd200d0, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0203.456] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd200d0, dwReserved1=0x31c7f8, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0203.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0203.457] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0203.457] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 0 [0203.457] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0203.457] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd200d0, dwReserved1=0x31c7f8, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0203.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0203.457] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0203.457] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0203.457] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0203.457] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.457] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0203.458] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abf8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0203.458] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.458] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abf8) returned 0x10ab [0203.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0203.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0203.459] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19c [0203.459] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0203.459] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0203.531] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x19c, lpOverlapped=0x0) returned 1 [0203.532] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x1a0, lpOverlapped=0x0) returned 1 [0203.533] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.555] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.566] CloseHandle (hObject=0x108) returned 1 [0203.566] CloseHandle (hObject=0x10c) returned 1 [0203.566] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\6465736b746f70.ini")) returned 0 [0203.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\6465736b746f70.ini")) returned 0x20 [0203.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325098 [0203.568] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0203.568] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0203.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 1 [0203.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 0xffffffff [0203.569] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0203.569] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0203.569] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.569] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0203.569] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0203.570] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0203.570] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.570] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af90) returned 0x10ab [0203.570] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0203.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0203.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\476F6F676C65204368726F6D65.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\476f6f676c65204368726f6d65.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0203.571] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8dd [0203.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0203.571] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0203.670] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8dd, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x8dd, lpOverlapped=0x0) returned 1 [0203.670] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x8e0, lpOverlapped=0x0) returned 1 [0203.671] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.694] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.706] CloseHandle (hObject=0x10c) returned 1 [0203.706] CloseHandle (hObject=0x108) returned 1 [0203.706] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\476F6F676C65204368726F6D65.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\476f6f676c65204368726f6d65.lnk")) returned 0 [0203.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\476F6F676C65204368726F6D65.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\476f6f676c65204368726f6d65.lnk")) returned 0x20 [0203.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x325098 [0203.707] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0 [0203.707] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0203.707] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 1 [0203.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 0xffffffff [0203.709] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0203.709] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0203.709] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.710] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0203.710] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0203.710] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0203.710] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.710] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f8) returned 0x10ab [0203.710] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0203.710] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0203.710] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\496E7465726E6574204578706C6F72657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\496e7465726e6574204578706c6f72657220283229.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0203.711] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ad [0203.711] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0203.712] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0203.800] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x5ad, lpOverlapped=0x0) returned 1 [0203.801] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x5b0, lpOverlapped=0x0) returned 1 [0203.802] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.825] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.836] CloseHandle (hObject=0x108) returned 1 [0203.836] CloseHandle (hObject=0x10c) returned 1 [0203.836] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\496E7465726E6574204578706C6F72657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\496e7465726e6574204578706c6f72657220283229.lnk")) returned 0 [0203.838] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\496E7465726E6574204578706C6F72657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\496e7465726e6574204578706c6f72657220283229.lnk")) returned 0x20 [0203.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x325098 [0203.838] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0203.838] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0203.838] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 1 [0203.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 0xffffffff [0203.839] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0203.840] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0203.840] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.840] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0203.840] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae1c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0203.840] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.840] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae1c) returned 0x10ab [0203.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0203.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\496E7465726E6574204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\496e7465726e6574204578706c6f726572.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0203.842] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a9 [0203.842] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0203.842] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0203.932] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x5a9, lpOverlapped=0x0) returned 1 [0203.933] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x5b0, lpOverlapped=0x0) returned 1 [0203.934] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.958] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.971] CloseHandle (hObject=0x10c) returned 1 [0203.971] CloseHandle (hObject=0x108) returned 1 [0203.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\496E7465726E6574204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\496e7465726e6574204578706c6f726572.lnk")) returned 0 [0203.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\496E7465726E6574204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\496e7465726e6574204578706c6f726572.lnk")) returned 0x20 [0203.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x325098 [0203.972] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0203.972] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0203.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 1 [0203.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0xffffffff [0203.973] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0203.974] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0203.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0203.974] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0203.974] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0203.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0203.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0203.974] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0203.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0203.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\4D6F7A696C6C612046697265666F78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\4d6f7a696c6c612046697265666f78.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0203.976] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x491 [0203.976] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0203.976] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0204.048] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x491, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x491, lpOverlapped=0x0) returned 1 [0204.049] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x4a0, lpOverlapped=0x0) returned 1 [0204.050] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.073] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.084] CloseHandle (hObject=0x108) returned 1 [0204.084] CloseHandle (hObject=0x10c) returned 1 [0204.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\4D6F7A696C6C612046697265666F78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\4d6f7a696c6c612046697265666f78.lnk")) returned 0 [0204.085] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\4D6F7A696C6C612046697265666F78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\4d6f7a696c6c612046697265666f78.lnk")) returned 0x20 [0204.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0x325098 [0204.085] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0204.085] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0204.085] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 1 [0204.087] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 0xffffffff [0204.087] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0204.088] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0204.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0204.088] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0204.088] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0204.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b090) returned 0x10ab [0204.088] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0204.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0204.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204578706C6F72657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204578706c6f72657220283229.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0204.090] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0204.090] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0204.090] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0204.185] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x4cc, lpOverlapped=0x0) returned 1 [0204.186] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x4d0, lpOverlapped=0x0) returned 1 [0204.187] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.210] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.221] CloseHandle (hObject=0x10c) returned 1 [0204.221] CloseHandle (hObject=0x108) returned 1 [0204.221] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204578706C6F72657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204578706c6f72657220283229.lnk")) returned 0 [0204.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204578706C6F72657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204578706c6f72657220283229.lnk")) returned 0x20 [0204.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0x325098 [0204.222] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0 [0204.222] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0204.222] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 1 [0204.223] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 0xffffffff [0204.224] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0204.224] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0204.224] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.224] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0204.224] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0204.225] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0204.225] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.225] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0204.225] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0204.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0204.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204578706c6f726572.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0204.226] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0204.226] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0204.227] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0204.315] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x4cc, lpOverlapped=0x0) returned 1 [0204.319] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x4d0, lpOverlapped=0x0) returned 1 [0204.319] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.342] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.353] CloseHandle (hObject=0x108) returned 1 [0204.353] CloseHandle (hObject=0x10c) returned 1 [0204.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204578706c6f726572.lnk")) returned 0 [0204.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204578706c6f726572.lnk")) returned 0x20 [0204.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x325098 [0204.354] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0204.354] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0204.354] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 1 [0204.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0xffffffff [0204.355] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0204.356] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0204.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0204.356] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0204.356] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0204.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0204.356] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0204.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0204.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204D6564696120506C6179657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204d6564696120506c6179657220283229.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0204.358] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60b [0204.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0204.358] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0204.446] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x60b, lpOverlapped=0x0) returned 1 [0204.447] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x610, lpOverlapped=0x0) returned 1 [0204.448] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.471] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.482] CloseHandle (hObject=0x10c) returned 1 [0204.482] CloseHandle (hObject=0x108) returned 1 [0204.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204D6564696120506C6179657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204d6564696120506c6179657220283229.lnk")) returned 0 [0204.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204D6564696120506C6179657220283229.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204d6564696120506c6179657220283229.lnk")) returned 0x20 [0204.484] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0x325098 [0204.484] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0 [0204.484] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0204.484] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 1 [0204.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 0xffffffff [0204.485] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0204.485] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0204.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0204.486] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ade0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0204.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ade0) returned 0x10ab [0204.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0204.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204D6564696120506C61796572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204d6564696120506c61796572.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0204.487] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60b [0204.487] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0204.488] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0204.577] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x60b, lpOverlapped=0x0) returned 1 [0204.578] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x610, lpOverlapped=0x0) returned 1 [0204.579] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.609] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.621] CloseHandle (hObject=0x108) returned 1 [0204.621] CloseHandle (hObject=0x10c) returned 1 [0204.621] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204D6564696120506C61796572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204d6564696120506c61796572.lnk")) returned 0 [0204.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\57696E646F7773204D6564696120506C61796572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\57696e646f7773204d6564696120506c61796572.lnk")) returned 0x20 [0204.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x325098 [0204.622] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0204.622] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0204.622] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 1 [0204.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0xffffffff [0204.623] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0204.623] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0204.623] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd200d0, dwReserved1=0x31c7f8, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0204.623] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0204.623] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0204.624] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0204.624] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.624] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0204.624] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0204.624] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0204.624] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.624] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b034) returned 0x10ab [0204.624] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0204.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0204.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\57696E646F77205377697463686572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\57696e646f77205377697463686572.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0204.626] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0204.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0204.626] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0204.723] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0204.724] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0204.724] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.747] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.759] CloseHandle (hObject=0x100) returned 1 [0204.759] CloseHandle (hObject=0x104) returned 1 [0204.759] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\57696E646F77205377697463686572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\57696e646f77205377697463686572.lnk")) returned 0 [0204.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\57696E646F77205377697463686572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\57696e646f77205377697463686572.lnk")) returned 0x20 [0204.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x325018 [0204.760] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0204.760] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0204.760] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0204.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0xffffffff [0204.761] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0204.761] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0204.761] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="UserData", cAlternateFileName="")) returned 1 [0204.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0204.762] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0204.762] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Low", cAlternateFileName="")) returned 1 [0204.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd600d4, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325018 [0204.762] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd600d4, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0204.762] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd600d4, dwReserved1=0x31c7f8, cFileName="65UX3YG0", cAlternateFileName="")) returned 1 [0204.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0204.762] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.762] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.762] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0204.762] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd600d4, dwReserved1=0x31c7f8, cFileName="AY721QDR", cAlternateFileName="")) returned 1 [0204.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0204.763] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.763] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.763] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0204.763] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd600d4, dwReserved1=0x31c7f8, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1 [0204.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0204.763] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.763] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.763] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0204.763] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xd600d4, dwReserved1=0x31c7f8, cFileName="index.dat", cAlternateFileName="")) returned 1 [0204.764] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0204.764] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.764] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0204.764] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0204.764] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0204.764] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.764] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0204.764] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0204.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0204.765] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0204.767] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0204.767] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0204.768] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0204.855] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x8000, lpOverlapped=0x0) returned 1 [0204.857] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x8010, lpOverlapped=0x0) returned 1 [0204.859] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.881] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.892] CloseHandle (hObject=0x100) returned 1 [0204.892] CloseHandle (hObject=0x10c) returned 1 [0204.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\696e646578.dat")) returned 0 [0204.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\696e646578.dat")) returned 0x2020 [0204.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325058 [0204.894] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0204.894] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0204.894] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat")) returned 1 [0204.895] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat")) returned 0xffffffff [0204.895] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1 [0204.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc200c0, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325058 [0204.895] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc200c0, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0204.895] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc200c0, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 0 [0204.895] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0204.895] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 0 [0204.895] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0204.895] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Low", cAlternateFileName="")) returned 0 [0204.895] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0204.895] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="UserData", cAlternateFileName="")) returned 0 [0204.895] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0204.895] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x30f830, cFileName="MMC", cAlternateFileName="")) returned 1 [0204.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0204.896] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0204.896] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 0 [0204.896] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0204.896] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x30f830, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0204.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0204.897] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0204.898] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="14", cAlternateFileName="")) returned 1 [0204.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0204.900] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0204.900] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="1033", cAlternateFileName="")) returned 1 [0204.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0204.901] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.901] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 1 [0204.902] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0204.902] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.902] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0204.902] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29be0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0204.902] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.902] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29be0) returned 0x10ab [0204.902] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 0 [0204.902] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0204.902] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="1033", cAlternateFileName="")) returned 0 [0204.902] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0204.902] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="14", cAlternateFileName="")) returned 0 [0204.902] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0204.902] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x30f830, cFileName="Network", cAlternateFileName="")) returned 1 [0204.902] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0204.903] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0204.903] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0204.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0204.903] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0204.903] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Pbk", cAlternateFileName="")) returned 1 [0204.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0204.903] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.903] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0204.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0204.903] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.903] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0204.904] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0204.904] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.904] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0204.904] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0204.904] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0c8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0204.904] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0204.904] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0c8) returned 0x10ab [0204.904] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0204.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0204.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\72617370686F6E65.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\72617370686f6e65.pbk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0204.906] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0204.906] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0204.906] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0205.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\72617370686F6E65.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\72617370686f6e65.pbk")) returned 0 [0205.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\72617370686F6E65.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\72617370686f6e65.pbk")) returned 0x2020 [0205.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0x325098 [0205.015] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0205.015] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0205.015] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk")) returned 1 [0205.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk")) returned 0xffffffff [0205.016] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0205.016] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0205.016] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0205.016] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0205.016] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Pbk", cAlternateFileName="")) returned 0 [0205.016] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0205.016] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0205.016] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0205.016] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x30f830, cFileName="Office", cAlternateFileName="")) returned 1 [0205.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0205.018] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0205.018] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0205.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.019] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.019] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a1b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.019] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.019] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a1b8) returned 0x10ab [0205.019] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Recent", cAlternateFileName="")) returned 1 [0205.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0205.020] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0205.020] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0205.020] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.020] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.020] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.020] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.020] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.020] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2fc) returned 0x10ab [0205.020] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="index.dat", cAlternateFileName="")) returned 1 [0205.020] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.020] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.021] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.021] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a3a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.021] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.021] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a3a8) returned 0x10ab [0205.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0205.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0205.022] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34 [0205.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0205.023] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0205.110] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x34, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x34, lpOverlapped=0x0) returned 1 [0205.112] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x40, lpOverlapped=0x0) returned 1 [0205.112] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.135] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.146] CloseHandle (hObject=0x104) returned 1 [0205.146] CloseHandle (hObject=0x10c) returned 1 [0205.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\696e646578.dat")) returned 0 [0205.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\696e646578.dat")) returned 0x2020 [0205.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325018 [0205.147] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0205.147] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0205.147] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 1 [0205.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 0xffffffff [0205.148] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1 [0205.149] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.149] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a62c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a62c) returned 0x10ab [0205.149] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0205.149] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0205.149] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Recent", cAlternateFileName="")) returned 0 [0205.149] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0205.149] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x30f830, cFileName="Outlook", cAlternateFileName="")) returned 1 [0205.149] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x184b4e, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0205.150] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x184b4e, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0205.150] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x184b4e, dwReserved1=0x18ed24, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0205.151] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.151] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a654, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a654) returned 0x10ab [0205.151] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0205.151] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.151] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a668, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a668) returned 0x10ab [0205.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0205.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\4F75746C6F6F6B.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\4f75746c6f6f6b.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0205.153] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a2 [0205.153] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0205.153] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0205.250] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9a2, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x9a2, lpOverlapped=0x0) returned 1 [0205.253] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x9b0, lpOverlapped=0x0) returned 1 [0205.254] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.277] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.288] CloseHandle (hObject=0xf4) returned 1 [0205.288] CloseHandle (hObject=0x10c) returned 1 [0205.288] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\4F75746C6F6F6B.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\4f75746c6f6f6b.xml")) returned 0 [0205.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\4F75746C6F6F6B.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\4f75746c6f6f6b.xml")) returned 0x2020 [0205.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Outlook.xml", cAlternateFileName="")) returned 0x324fd8 [0205.290] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0205.290] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0205.290] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 1 [0205.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 0xffffffff [0205.291] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0205.291] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0205.291] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x30f830, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0205.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0205.292] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0205.292] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 0 [0205.292] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0205.292] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x30f830, cFileName="Proof", cAlternateFileName="")) returned 1 [0205.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0205.293] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0205.293] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 0 [0205.293] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0205.293] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x30f830, cFileName="Protect", cAlternateFileName="")) returned 1 [0205.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0205.293] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0205.293] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0205.294] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.294] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.294] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29604, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.294] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.294] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29604) returned 0x10ab [0205.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0205.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\4352454448495354" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\4352454448495354"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0205.295] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x138 [0205.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0205.296] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0205.370] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x138, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x138, lpOverlapped=0x0) returned 1 [0205.371] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x140, lpOverlapped=0x0) returned 1 [0205.372] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.489] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.500] CloseHandle (hObject=0x10c) returned 1 [0205.500] CloseHandle (hObject=0xf4) returned 1 [0205.500] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\4352454448495354" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\4352454448495354")) returned 0 [0205.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\4352454448495354" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\4352454448495354")) returned 0x2020 [0205.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CREDHIST", cAlternateFileName="")) returned 0x324fd8 [0205.501] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CREDHIST", cAlternateFileName="")) returned 0 [0205.501] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0205.501] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist")) returned 1 [0205.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist")) returned 0xffffffff [0205.502] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0205.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0205.504] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0205.504] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x920090, dwReserved1=0x31c7f8, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0205.505] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.505] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.505] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.505] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29af8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.505] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.505] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29af8) returned 0x10ab [0205.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0205.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\62653562346662642D636239392D343566352D393436322D356638393664643361366239" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\62653562346662642d636239392d343566352d393436322d356638393664643361366239"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0205.506] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d4 [0205.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0205.506] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0205.579] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d4, lpOverlapped=0x0) returned 1 [0205.580] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0205.581] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.621] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.650] CloseHandle (hObject=0x10c) returned 1 [0205.650] CloseHandle (hObject=0x104) returned 1 [0205.651] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\62653562346662642D636239392D343566352D393436322D356638393664643361366239" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\62653562346662642d636239392d343566352d393436322d356638393664643361366239")) returned 0 [0205.653] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\62653562346662642D636239392D343566352D393436322D356638393664643361366239" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\62653562346662642d636239392d343566352d393436322d356638393664643361366239")) returned 0x2020 [0205.653] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 0x325018 [0205.653] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 0 [0205.653] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0205.653] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9")) returned 1 [0205.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9")) returned 0xffffffff [0205.654] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0205.655] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.655] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.655] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.655] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.655] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.656] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a088) returned 0x10ab [0205.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0205.657] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\507265666572726564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\507265666572726564"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0205.658] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0205.658] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0205.658] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0205.748] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0205.750] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0205.751] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.773] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.784] CloseHandle (hObject=0x104) returned 1 [0205.784] CloseHandle (hObject=0x10c) returned 1 [0205.784] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\507265666572726564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\507265666572726564")) returned 0 [0205.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\507265666572726564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\507265666572726564")) returned 0x2020 [0205.785] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0x325018 [0205.785] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0205.785] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0205.785] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred")) returned 1 [0205.790] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred")) returned 0xffffffff [0205.790] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0205.790] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0205.790] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69309390, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x69309390, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1 [0205.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69309390, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x69309390, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0205.790] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69309390, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x69309390, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.790] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1 [0205.791] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.791] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.791] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.791] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a710, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.791] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.791] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a710) returned 0x10ab [0205.791] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0205.792] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\30323534306131302D376562372D346232302D613863372D343730663839383633383963" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\30323534306131302d376562372d346232302d613863372d343730663839383633383963"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0205.793] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d4 [0205.793] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0205.793] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0205.890] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d4, lpOverlapped=0x0) returned 1 [0205.891] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0205.892] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.914] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.927] CloseHandle (hObject=0x10c) returned 1 [0205.927] CloseHandle (hObject=0x104) returned 1 [0205.927] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\30323534306131302D376562372D346232302D613863372D343730663839383633383963" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\30323534306131302d376562372d346232302d613863372d343730663839383633383963")) returned 0 [0205.928] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\30323534306131302D376562372D346232302D613863372D343730663839383633383963" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\30323534306131302d376562372d346232302d613863372d343730663839383633383963")) returned 0x2020 [0205.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 0x325018 [0205.928] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 0 [0205.928] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0205.928] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c")) returned 1 [0205.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c")) returned 0xffffffff [0205.929] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1 [0205.930] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0205.930] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.930] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0205.930] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acc8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0205.930] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0205.930] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acc8) returned 0x10ab [0205.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0205.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\30653135343736642D643866652D343663612D383039392D656264636638306636333763" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\30653135343736642d643866652d343663612d383039392d656264636638306636333763"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0205.931] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d4 [0205.931] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0205.932] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0206.022] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d4, lpOverlapped=0x0) returned 1 [0206.023] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0206.024] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.047] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.057] CloseHandle (hObject=0x104) returned 1 [0206.058] CloseHandle (hObject=0x10c) returned 1 [0206.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\30653135343736642D643866652D343663612D383039392D656264636638306636333763" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\30653135343736642d643866652d343663612d383039392d656264636638306636333763")) returned 0 [0206.059] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\30653135343736642D643866652D343663612D383039392D656264636638306636333763" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\30653135343736642d643866652d343663612d383039392d656264636638306636333763")) returned 0x2020 [0206.059] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 0x325018 [0206.059] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 0 [0206.059] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0206.059] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c")) returned 1 [0206.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c")) returned 0xffffffff [0206.060] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1 [0206.060] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0206.060] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.060] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0206.060] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0206.061] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0206.061] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.061] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0206.061] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0206.061] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0206.061] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\31303261376263382D336638352D346262342D383430612D333832353764323936356432" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\31303261376263382d336638352d346262342d383430612d333832353764323936356432"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0206.062] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d4 [0206.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0206.062] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0206.138] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d4, lpOverlapped=0x0) returned 1 [0206.139] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0206.140] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.163] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.174] CloseHandle (hObject=0x10c) returned 1 [0206.174] CloseHandle (hObject=0x104) returned 1 [0206.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\31303261376263382D336638352D346262342D383430612D333832353764323936356432" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\31303261376263382d336638352d346262342d383430612d333832353764323936356432")) returned 0 [0206.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\31303261376263382D336638352D346262342D383430612D333832353764323936356432" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\31303261376263382d336638352d346262342d383430612d333832353764323936356432")) returned 0x2020 [0206.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 0x325018 [0206.175] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 0 [0206.175] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0206.175] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2")) returned 1 [0206.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2")) returned 0xffffffff [0206.176] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1 [0206.177] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0206.177] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.177] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0206.177] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0206.177] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0206.177] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.177] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0c4) returned 0x10ab [0206.177] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0206.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0206.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\32626539383961302D313661312D343234622D393231312D353161613362623433653564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\32626539383961302d313661312d343234622d393231312d353161613362623433653564"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0206.179] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d4 [0206.179] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0206.179] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0206.277] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d4, lpOverlapped=0x0) returned 1 [0206.278] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0206.279] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.301] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.313] CloseHandle (hObject=0x104) returned 1 [0206.313] CloseHandle (hObject=0x10c) returned 1 [0206.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\32626539383961302D313661312D343234622D393231312D353161613362623433653564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\32626539383961302d313661312d343234622d393231312d353161613362623433653564")) returned 0 [0206.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\32626539383961302D313661312D343234622D393231312D353161613362623433653564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\32626539383961302d313661312d343234622d393231312d353161613362623433653564")) returned 0x2020 [0206.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 0x325018 [0206.314] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 0 [0206.314] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0206.314] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d")) returned 1 [0206.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d")) returned 0xffffffff [0206.315] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa00ab2f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa00ab2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa00ab2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="91b7b5ee-2a81-4b09-b9ee-95f963875d9e", cAlternateFileName="91B7B5~1")) returned 1 [0206.316] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0206.316] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.316] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0206.316] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a63c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0206.316] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.316] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a63c) returned 0x10ab [0206.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0206.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\39316237623565652D326138312D346230392D623965652D393566393633383735643965" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\39316237623565652d326138312d346230392d623965652d393566393633383735643965"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0206.317] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d4 [0206.317] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0206.317] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0206.421] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d4, lpOverlapped=0x0) returned 1 [0206.422] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0206.423] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.446] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.457] CloseHandle (hObject=0x10c) returned 1 [0206.457] CloseHandle (hObject=0x104) returned 1 [0206.457] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\39316237623565652D326138312D346230392D623965652D393566393633383735643965" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\39316237623565652d326138312d346230392d623965652d393566393633383735643965")) returned 0 [0206.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\39316237623565652D326138312D346230392D623965652D393566393633383735643965" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\39316237623565652d326138312d346230392d623965652d393566393633383735643965")) returned 0x2020 [0206.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa00ab2f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa00ab2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa00ab2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="91b7b5ee-2a81-4b09-b9ee-95f963875d9e", cAlternateFileName="91B7B5~1")) returned 0x325018 [0206.459] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa00ab2f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa00ab2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa00ab2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="91b7b5ee-2a81-4b09-b9ee-95f963875d9e", cAlternateFileName="91B7B5~1")) returned 0 [0206.459] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0206.459] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e")) returned 1 [0206.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\91b7b5ee-2a81-4b09-b9ee-95f963875d9e")) returned 0xffffffff [0206.460] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x69309390, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x69309390, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x69309390, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="f7fe6970-e15d-41da-bc5e-fd08aa004bf1", cAlternateFileName="F7FE69~1")) returned 1 [0206.461] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0206.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0206.461] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac14, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0206.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac14) returned 0x10ab [0206.461] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0206.461] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66376665363937302D653135642D343164612D626335652D666430386161303034626631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66376665363937302d653135642d343164612d626335652d666430386161303034626631"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0206.462] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d4 [0206.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0206.463] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0206.561] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d4, lpOverlapped=0x0) returned 1 [0206.562] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0206.563] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.586] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.596] CloseHandle (hObject=0x104) returned 1 [0206.596] CloseHandle (hObject=0x10c) returned 1 [0206.597] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66376665363937302D653135642D343164612D626335652D666430386161303034626631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66376665363937302d653135642d343164612d626335652d666430386161303034626631")) returned 0 [0206.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66376665363937302D653135642D343164612D626335652D666430386161303034626631" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66376665363937302d653135642d343164612d626335652d666430386161303034626631")) returned 0x2020 [0206.598] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x69309390, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x69309390, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x69309390, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="f7fe6970-e15d-41da-bc5e-fd08aa004bf1", cAlternateFileName="F7FE69~1")) returned 0x325018 [0206.598] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x69309390, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x69309390, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x69309390, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="f7fe6970-e15d-41da-bc5e-fd08aa004bf1", cAlternateFileName="F7FE69~1")) returned 0 [0206.598] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0206.598] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1")) returned 1 [0206.600] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\f7fe6970-e15d-41da-bc5e-fd08aa004bf1")) returned 0xffffffff [0206.600] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1 [0206.600] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0206.600] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.601] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0206.601] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0206.601] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0d8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0206.601] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.601] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0d8) returned 0x10ab [0206.601] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0206.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0206.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66626265373264622D616664382D343433622D383864642D363462323033383837303064" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66626265373264622d616664382d343433622d383864642d363462323033383837303064"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0206.602] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d4 [0206.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0206.603] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0206.676] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1d4, lpOverlapped=0x0) returned 1 [0206.677] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0206.678] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.700] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.711] CloseHandle (hObject=0x10c) returned 1 [0206.711] CloseHandle (hObject=0x104) returned 1 [0206.711] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66626265373264622D616664382D343433622D383864642D363462323033383837303064" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66626265373264622d616664382d343433622d383864642d363462323033383837303064")) returned 0 [0206.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\66626265373264622D616664382D343433622D383864642D363462323033383837303064" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\66626265373264622d616664382d343433622d383864642d363462323033383837303064")) returned 0x2020 [0206.712] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 0x325018 [0206.713] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 0 [0206.713] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0206.713] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d")) returned 1 [0206.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d")) returned 0xffffffff [0206.714] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6937b7b0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0206.714] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0206.714] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.714] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0206.714] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0206.715] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afd8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0206.715] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.715] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afd8) returned 0x10ab [0206.715] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0206.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0206.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\507265666572726564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\507265666572726564"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0206.716] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0206.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0206.716] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0206.805] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0206.806] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0206.807] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.829] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.840] CloseHandle (hObject=0x104) returned 1 [0206.840] CloseHandle (hObject=0x10c) returned 1 [0206.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\507265666572726564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\507265666572726564")) returned 0 [0206.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\507265666572726564" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\507265666572726564")) returned 0x2020 [0206.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6937b7b0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0x325018 [0206.841] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6937b7b0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0206.841] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0206.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred")) returned 1 [0206.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred")) returned 0xffffffff [0206.842] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6937b7b0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0206.843] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0206.843] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0206.843] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0206.843] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.843] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0206.843] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0206.844] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b054, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0206.844] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.844] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b054) returned 0x10ab [0206.844] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0206.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0206.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\53594E4348495354" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\53594e4348495354"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0206.845] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c [0206.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0206.846] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0206.939] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4c, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x4c, lpOverlapped=0x0) returned 1 [0206.939] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x50, lpOverlapped=0x0) returned 1 [0206.941] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.965] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.976] CloseHandle (hObject=0xf4) returned 1 [0206.976] CloseHandle (hObject=0x10c) returned 1 [0206.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\53594E4348495354" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\53594e4348495354")) returned 0 [0206.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\53594E4348495354" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\53594e4348495354")) returned 0x2020 [0206.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="SYNCHIST", cAlternateFileName="")) returned 0x324fd8 [0206.977] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0206.977] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0206.978] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist")) returned 1 [0206.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist")) returned 0xffffffff [0206.978] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0206.978] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0206.979] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0206.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0206.980] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0206.980] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 0 [0206.980] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0206.980] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0206.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0206.982] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0206.982] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0206.982] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0206.982] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0206.983] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a710, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0206.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0206.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a710) returned 0x10ab [0206.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0206.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\436F6E74656E7453746F7265.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\436f6e74656e7453746f7265.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0206.984] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa8 [0206.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0206.985] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0207.072] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xa8, lpOverlapped=0x0) returned 1 [0207.073] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xb0, lpOverlapped=0x0) returned 1 [0207.074] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.097] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.108] CloseHandle (hObject=0x10c) returned 1 [0207.108] CloseHandle (hObject=0xf4) returned 1 [0207.108] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\436F6E74656E7453746F7265.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\436f6e74656e7453746f7265.xml")) returned 0 [0207.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\436F6E74656E7453746F7265.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\436f6e74656e7453746f7265.xml")) returned 0x2020 [0207.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0x324fd8 [0207.109] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0 [0207.109] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0207.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml")) returned 1 [0207.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml")) returned 0xffffffff [0207.110] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0 [0207.110] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0207.110] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Speech", cAlternateFileName="")) returned 1 [0207.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0207.111] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0207.111] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 0 [0207.111] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0207.111] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0207.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0207.111] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0207.112] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="My", cAlternateFileName="")) returned 1 [0207.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0207.112] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0207.112] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0207.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0207.112] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.112] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0207.112] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.112] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName="CRLs", cAlternateFileName="")) returned 1 [0207.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0207.113] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.113] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0207.113] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.113] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName="CTLs", cAlternateFileName="")) returned 1 [0207.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0207.113] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.113] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0207.113] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.113] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName="CTLs", cAlternateFileName="")) returned 0 [0207.113] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0207.113] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="My", cAlternateFileName="")) returned 0 [0207.113] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0207.113] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0207.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77353873, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0207.114] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77353873, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0207.114] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x77353873, dwReserved1=0x7758b613, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0207.115] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.115] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.115] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.115] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.115] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.115] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa50) returned 0x10ab [0207.115] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x77353873, dwReserved1=0x7758b613, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0 [0207.115] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0207.115] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="UProof", cAlternateFileName="")) returned 1 [0207.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0207.116] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0207.116] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0207.117] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.117] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2abe4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2abe4) returned 0x10ab [0207.117] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0207.117] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0207.117] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Windows", cAlternateFileName="")) returned 1 [0207.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0207.117] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0207.117] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Cookies", cAlternateFileName="")) returned 1 [0207.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0207.117] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0207.118] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0207.118] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.118] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.118] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.118] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.118] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.118] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae58) returned 0x10ab [0207.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0207.119] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4061646F62655B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4061646f62655b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0207.120] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53 [0207.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0207.120] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0207.193] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x53, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x53, lpOverlapped=0x0) returned 1 [0207.194] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x60, lpOverlapped=0x0) returned 1 [0207.195] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.227] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.237] CloseHandle (hObject=0x10c) returned 1 [0207.238] CloseHandle (hObject=0x104) returned 1 [0207.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4061646F62655B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4061646f62655b315d.txt")) returned 0 [0207.239] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4061646F62655B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4061646f62655b315d.txt")) returned 0x2020 [0207.239] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0x325018 [0207.239] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0 [0207.239] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.239] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 1 [0207.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 0xffffffff [0207.240] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1 [0207.241] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.241] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.241] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.241] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29818, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.241] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.241] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29818) returned 0x10ab [0207.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0207.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4061646F62655B335D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4061646f62655b335d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0207.243] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x227 [0207.243] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0207.244] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0207.333] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x227, lpOverlapped=0x0) returned 1 [0207.334] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x230, lpOverlapped=0x0) returned 1 [0207.335] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.358] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.369] CloseHandle (hObject=0x104) returned 1 [0207.369] CloseHandle (hObject=0x10c) returned 1 [0207.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4061646F62655B335D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4061646f62655b335d.txt")) returned 0 [0207.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4061646F62655B335D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4061646f62655b335d.txt")) returned 0x2020 [0207.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 0x325018 [0207.370] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 0 [0207.371] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.371] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 1 [0207.371] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 0xffffffff [0207.371] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1 [0207.372] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.372] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.372] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.372] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2997c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.372] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.372] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2997c) returned 0x10ab [0207.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0207.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4064656D6465785B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4064656d6465785b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0207.375] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1 [0207.375] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0207.375] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0207.464] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xf1, lpOverlapped=0x0) returned 1 [0207.465] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x100, lpOverlapped=0x0) returned 1 [0207.466] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.489] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.499] CloseHandle (hObject=0x10c) returned 1 [0207.499] CloseHandle (hObject=0x104) returned 1 [0207.500] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4064656D6465785B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4064656d6465785b315d.txt")) returned 0 [0207.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4064656D6465785B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4064656d6465785b315d.txt")) returned 0x2020 [0207.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 0x325018 [0207.501] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 0 [0207.501] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.501] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 1 [0207.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 0xffffffff [0207.502] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1 [0207.503] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.503] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.503] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0207.503] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.503] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0dc) returned 0x10ab [0207.504] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0207.504] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0207.504] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4064706D2E64656D6465785B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4064706d2e64656d6465785b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0207.505] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0207.505] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0207.506] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0207.595] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6f, lpOverlapped=0x0) returned 1 [0207.601] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x70, lpOverlapped=0x0) returned 1 [0207.605] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.627] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.638] CloseHandle (hObject=0x104) returned 1 [0207.638] CloseHandle (hObject=0x10c) returned 1 [0207.638] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4064706D2E64656D6465785B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4064706d2e64656d6465785b325d.txt")) returned 0 [0207.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4064706D2E64656D6465785B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4064706d2e64656d6465785b325d.txt")) returned 0x2020 [0207.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 0x325018 [0207.640] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 0 [0207.640] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.640] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 1 [0207.641] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 0xffffffff [0207.641] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0207.641] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.641] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.641] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.641] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adb0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.641] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.641] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adb0) returned 0x10ab [0207.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0207.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4065766572657374746563685B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4065766572657374746563685b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0207.643] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e [0207.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0207.643] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0207.744] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x6e, lpOverlapped=0x0) returned 1 [0207.745] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x70, lpOverlapped=0x0) returned 1 [0207.746] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.769] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.780] CloseHandle (hObject=0x10c) returned 1 [0207.780] CloseHandle (hObject=0x104) returned 1 [0207.780] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4065766572657374746563685B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4065766572657374746563685b315d.txt")) returned 0 [0207.781] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A4065766572657374746563685B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a4065766572657374746563685b315d.txt")) returned 0x2020 [0207.781] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0x325018 [0207.782] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0 [0207.782] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.782] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 1 [0207.783] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 0xffffffff [0207.783] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0207.783] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.783] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.783] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.784] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0207.784] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b068, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.784] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.784] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b068) returned 0x10ab [0207.785] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0207.785] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0207.789] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0207.790] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114 [0207.790] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0207.790] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0207.865] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x114, lpOverlapped=0x0) returned 1 [0207.866] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0207.867] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.890] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.901] CloseHandle (hObject=0x104) returned 1 [0207.901] CloseHandle (hObject=0x10c) returned 1 [0207.901] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b325d.txt")) returned 0 [0207.902] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b325d.txt")) returned 0x2020 [0207.902] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0x325018 [0207.902] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0 [0207.902] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0207.902] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 1 [0207.903] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 0xffffffff [0207.903] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1 [0207.903] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0207.903] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.903] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0207.904] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c293bc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0207.904] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0207.904] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c293bc) returned 0x10ab [0207.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0207.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A406D6C3331345B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a406d6c3331345b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0207.905] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56 [0207.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0207.905] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0207.997] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x56, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x56, lpOverlapped=0x0) returned 1 [0207.998] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x60, lpOverlapped=0x0) returned 1 [0207.999] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.022] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.033] CloseHandle (hObject=0x10c) returned 1 [0208.033] CloseHandle (hObject=0x104) returned 1 [0208.033] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A406D6C3331345B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a406d6c3331345b315d.txt")) returned 0 [0208.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A406D6C3331345B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a406d6c3331345b315d.txt")) returned 0x2020 [0208.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 0x325018 [0208.035] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 0 [0208.035] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0208.035] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 1 [0208.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 0xffffffff [0208.036] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1 [0208.037] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.037] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.037] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.037] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2adb0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.037] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.037] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2adb0) returned 0x10ab [0208.037] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0208.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A40726C63646E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a40726c63646e5b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0208.039] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e [0208.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0208.039] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0208.128] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x19e, lpOverlapped=0x0) returned 1 [0208.129] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0208.130] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.152] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.164] CloseHandle (hObject=0x104) returned 1 [0208.164] CloseHandle (hObject=0x10c) returned 1 [0208.164] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A40726C63646E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a40726c63646e5b325d.txt")) returned 0 [0208.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\3570356E72676A6E306A735F68616C706D63787A40726C63646E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\3570356e72676a6e306a735f68616c706d63787a40726c63646e5b325d.txt")) returned 0x2020 [0208.165] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0x325018 [0208.165] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0 [0208.165] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0208.165] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 1 [0208.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 0xffffffff [0208.166] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa1fc3250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="index.dat", cAlternateFileName="")) returned 1 [0208.166] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.166] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.167] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2995c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.167] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2995c) returned 0x10ab [0208.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.167] CloseHandle (hObject=0xffffffff) returned 0 [0208.167] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\696e646578.dat")) returned 0 [0208.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\696e646578.dat")) returned 0xffffffff [0208.167] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa1fc3250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325018 [0208.167] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa1fc3250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0208.167] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0208.167] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 0 [0208.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 0x2026 [0208.168] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0208.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x326f20, cFileName=".", cAlternateFileName="")) returned 0x325018 [0208.170] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x326f20, cFileName="..", cAlternateFileName="")) returned 1 [0208.171] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0xa400a2, dwReserved1=0x326f20, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 1 [0208.172] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.172] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.172] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.172] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ab4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.172] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.172] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ab4) returned 0x10ab [0208.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0208.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40616431332E61646661726D312E61646974696F6E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40616431332e61646661726d312e61646974696f6e5b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0208.173] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0208.173] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0208.174] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0208.272] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x66, lpOverlapped=0x0) returned 1 [0208.273] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x70, lpOverlapped=0x0) returned 1 [0208.274] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.296] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.308] CloseHandle (hObject=0x104) returned 1 [0208.308] CloseHandle (hObject=0x108) returned 1 [0208.308] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40616431332E61646661726D312E61646974696F6E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40616431332e61646661726d312e61646974696f6e5b315d.txt")) returned 0 [0208.309] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40616431332E61646661726D312E61646974696F6E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40616431332e61646661726d312e61646974696f6e5b315d.txt")) returned 0x2020 [0208.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 0x325058 [0208.309] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 0 [0208.309] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0208.309] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 1 [0208.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 0xffffffff [0208.310] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1 [0208.311] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.311] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.311] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.311] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0208.311] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.311] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.311] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0208.311] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0208.311] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0208.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061646661726D312E61646974696F6E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061646661726d312e61646974696f6e5b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0208.312] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0208.312] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0208.313] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0208.407] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x66, lpOverlapped=0x0) returned 1 [0208.409] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x70, lpOverlapped=0x0) returned 1 [0208.410] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.432] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.443] CloseHandle (hObject=0x108) returned 1 [0208.443] CloseHandle (hObject=0x104) returned 1 [0208.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061646661726D312E61646974696F6E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061646661726d312e61646974696f6e5b325d.txt")) returned 0 [0208.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061646661726D312E61646974696F6E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061646661726d312e61646974696f6e5b325d.txt")) returned 0x2020 [0208.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 0x325058 [0208.445] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 0 [0208.445] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0208.445] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 1 [0208.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 0xffffffff [0208.446] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1 [0208.446] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.446] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.446] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.446] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0208.447] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0208.447] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0208.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0208.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164666F726D6473705B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164666f726d6473705b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0208.448] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d [0208.448] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0208.448] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0208.521] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x5d, lpOverlapped=0x0) returned 1 [0208.522] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x60, lpOverlapped=0x0) returned 1 [0208.523] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.546] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.556] CloseHandle (hObject=0x104) returned 1 [0208.557] CloseHandle (hObject=0x108) returned 1 [0208.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164666F726D6473705B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164666f726d6473705b315d.txt")) returned 0 [0208.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164666F726D6473705B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164666f726d6473705b315d.txt")) returned 0x2020 [0208.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 0x325058 [0208.558] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 0 [0208.558] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0208.558] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 1 [0208.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 0xffffffff [0208.559] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1 [0208.559] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.559] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.559] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.559] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0208.560] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.560] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.560] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0dc) returned 0x10ab [0208.560] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0208.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0208.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164666F726D5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164666f726d5b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0208.561] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0208.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0208.561] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0208.650] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xea, lpOverlapped=0x0) returned 1 [0208.651] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xf0, lpOverlapped=0x0) returned 1 [0208.652] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.674] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.685] CloseHandle (hObject=0x108) returned 1 [0208.685] CloseHandle (hObject=0x104) returned 1 [0208.685] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164666F726D5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164666f726d5b315d.txt")) returned 0 [0208.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164666F726D5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164666f726d5b315d.txt")) returned 0x2020 [0208.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 0x325058 [0208.686] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 0 [0208.686] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0208.686] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 1 [0208.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 0xffffffff [0208.687] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1 [0208.688] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.688] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.688] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.688] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29570, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.688] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.688] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29570) returned 0x10ab [0208.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0208.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061646E78735B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061646e78735b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0208.690] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x242 [0208.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0208.690] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0208.779] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x242, lpOverlapped=0x0) returned 1 [0208.780] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x250, lpOverlapped=0x0) returned 1 [0208.781] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.804] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.815] CloseHandle (hObject=0x104) returned 1 [0208.815] CloseHandle (hObject=0x108) returned 1 [0208.815] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061646E78735B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061646e78735b315d.txt")) returned 0 [0208.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061646E78735B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061646e78735b315d.txt")) returned 0x2020 [0208.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 0x325058 [0208.817] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 0 [0208.817] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0208.817] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 1 [0208.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 0xffffffff [0208.818] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1 [0208.818] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.818] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.818] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.819] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c297ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.819] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.819] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c297ac) returned 0x10ab [0208.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0208.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164746563685B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164746563685b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0208.820] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x65 [0208.820] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0208.820] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0208.917] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x65, lpOverlapped=0x0) returned 1 [0208.919] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x70, lpOverlapped=0x0) returned 1 [0208.922] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.946] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.960] CloseHandle (hObject=0x108) returned 1 [0208.960] CloseHandle (hObject=0x104) returned 1 [0208.962] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164746563685B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164746563685b325d.txt")) returned 0 [0208.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164746563685B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164746563685b325d.txt")) returned 0x2020 [0208.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 0x325058 [0208.964] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 0 [0208.964] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0208.964] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 1 [0208.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 0xffffffff [0208.965] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1 [0208.968] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0208.968] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.971] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0208.971] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29b10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0208.972] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0208.972] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29b10) returned 0x10ab [0208.972] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0208.972] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164747230325B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164747230325b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0208.973] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52 [0208.973] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0208.973] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0209.046] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x52, lpOverlapped=0x0) returned 1 [0209.047] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x60, lpOverlapped=0x0) returned 1 [0209.048] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.071] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.082] CloseHandle (hObject=0x104) returned 1 [0209.082] CloseHandle (hObject=0x108) returned 1 [0209.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164747230325B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164747230325b315d.txt")) returned 0 [0209.083] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164747230325B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164747230325b315d.txt")) returned 0x2020 [0209.083] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 0x325058 [0209.083] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 0 [0209.084] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0209.084] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 1 [0209.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 0xffffffff [0209.085] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0209.085] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0209.085] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.085] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0209.085] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0209.085] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0209.085] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.086] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0209.086] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0209.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0209.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164766572746973696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164766572746973696e675b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0209.087] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0209.087] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0209.087] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0209.174] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x125, lpOverlapped=0x0) returned 1 [0209.175] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x130, lpOverlapped=0x0) returned 1 [0209.176] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.199] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.210] CloseHandle (hObject=0x108) returned 1 [0209.210] CloseHandle (hObject=0x104) returned 1 [0209.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164766572746973696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164766572746973696e675b315d.txt")) returned 0 [0209.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406164766572746973696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406164766572746973696e675b315d.txt")) returned 0x2020 [0209.211] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0x325058 [0209.211] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0 [0209.211] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0209.211] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 1 [0209.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 0xffffffff [0209.212] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1 [0209.213] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0209.213] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.213] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0209.213] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29314, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0209.213] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.213] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29314) returned 0x10ab [0209.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0209.214] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406170692E62696E675B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406170692e62696e675b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0209.215] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0209.215] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0209.215] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0209.312] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xdd, lpOverlapped=0x0) returned 1 [0209.314] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xe0, lpOverlapped=0x0) returned 1 [0209.315] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.337] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.348] CloseHandle (hObject=0x104) returned 1 [0209.348] CloseHandle (hObject=0x108) returned 1 [0209.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406170692E62696E675B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406170692e62696e675b325d.txt")) returned 0 [0209.349] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406170692E62696E675B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406170692e62696e675b325d.txt")) returned 0x2020 [0209.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 0x325058 [0209.349] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 0 [0209.349] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0209.349] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 1 [0209.350] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 0xffffffff [0209.350] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 1 [0209.351] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0209.351] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.351] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0209.351] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2968c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0209.351] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.351] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2968c) returned 0x10ab [0209.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0209.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061742E6174776F6C615B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061742e6174776f6c615b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0209.352] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x201 [0209.352] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0209.352] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0209.440] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x201, lpOverlapped=0x0) returned 1 [0209.441] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x210, lpOverlapped=0x0) returned 1 [0209.441] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.463] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.474] CloseHandle (hObject=0x108) returned 1 [0209.474] CloseHandle (hObject=0x104) returned 1 [0209.474] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061742E6174776F6C615B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061742e6174776f6c615b315d.txt")) returned 0 [0209.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4061742E6174776F6C615B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4061742e6174776f6c615b315d.txt")) returned 0x2020 [0209.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 0x325058 [0209.475] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 0 [0209.475] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0209.475] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 1 [0209.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 0xffffffff [0209.476] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 1 [0209.476] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0209.476] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.476] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0209.476] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0209.477] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0209.477] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.477] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0209.477] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0209.477] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0209.477] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4062696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4062696e675b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0209.479] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ea [0209.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0209.479] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0209.565] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ea, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1ea, lpOverlapped=0x0) returned 1 [0209.565] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1f0, lpOverlapped=0x0) returned 1 [0209.566] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.588] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.599] CloseHandle (hObject=0x104) returned 1 [0209.599] CloseHandle (hObject=0x108) returned 1 [0209.599] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4062696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4062696e675b315d.txt")) returned 0 [0209.600] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4062696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4062696e675b315d.txt")) returned 0x2020 [0209.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 0x325058 [0209.600] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 0 [0209.600] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0209.600] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 1 [0209.601] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 0xffffffff [0209.601] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0209.601] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0209.602] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.602] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0209.602] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0209.602] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0209.602] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.602] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0209.602] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0209.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0209.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40632E62696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40632e62696e675b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0209.603] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c8 [0209.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0209.603] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0209.695] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1c8, lpOverlapped=0x0) returned 1 [0209.696] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1d0, lpOverlapped=0x0) returned 1 [0209.696] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.718] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.729] CloseHandle (hObject=0x108) returned 1 [0209.729] CloseHandle (hObject=0x104) returned 1 [0209.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40632E62696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40632e62696e675b315d.txt")) returned 0 [0209.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40632E62696E675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40632e62696e675b315d.txt")) returned 0x2020 [0209.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0x325058 [0209.730] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0 [0209.730] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0209.730] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 1 [0209.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 0xffffffff [0209.731] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 1 [0209.732] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0209.732] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.732] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0209.732] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0209.732] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0209.732] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.732] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0209.732] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0209.732] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0209.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40632E6D736E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40632e6d736e5b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0209.734] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82 [0209.734] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0209.734] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0209.805] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x82, lpOverlapped=0x0) returned 1 [0209.806] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x90, lpOverlapped=0x0) returned 1 [0209.807] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.838] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.849] CloseHandle (hObject=0x104) returned 1 [0209.849] CloseHandle (hObject=0x108) returned 1 [0209.849] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40632E6D736E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40632e6d736e5b315d.txt")) returned 0 [0209.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40632E6D736E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40632e6d736e5b315d.txt")) returned 0x2020 [0209.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 0x325058 [0209.850] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 0 [0209.850] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0209.850] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 1 [0209.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 0xffffffff [0209.851] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 1 [0209.851] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0209.851] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.851] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0209.851] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0209.852] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0209.852] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.852] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0209.852] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0209.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0209.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40646F75626C65636C69636B5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40646f75626c65636c69636b5b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0209.853] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0209.853] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0209.853] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0209.941] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x110, lpOverlapped=0x0) returned 1 [0209.942] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x120, lpOverlapped=0x0) returned 1 [0209.942] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.965] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.975] CloseHandle (hObject=0x108) returned 1 [0209.975] CloseHandle (hObject=0x104) returned 1 [0209.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40646F75626C65636C69636B5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40646f75626c65636c69636b5b325d.txt")) returned 0 [0209.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40646F75626C65636C69636B5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40646f75626c65636c69636b5b325d.txt")) returned 0x2020 [0209.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 0x325058 [0209.977] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 0 [0209.977] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0209.977] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 1 [0209.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 0xffffffff [0209.978] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 1 [0209.978] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0209.978] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.978] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0209.978] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c292e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0209.978] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0209.978] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c292e8) returned 0x10ab [0209.978] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0209.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0209.979] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x256 [0209.979] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0209.979] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0210.065] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x256, lpOverlapped=0x0) returned 1 [0210.067] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x260, lpOverlapped=0x0) returned 1 [0210.068] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.090] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.101] CloseHandle (hObject=0x104) returned 1 [0210.101] CloseHandle (hObject=0x108) returned 1 [0210.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b315d.txt")) returned 0 [0210.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b315d.txt")) returned 0x2020 [0210.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 0x325058 [0210.102] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 0 [0210.102] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0210.103] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 1 [0210.103] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 0xffffffff [0210.103] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 1 [0210.104] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0210.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.104] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0210.104] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29680, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0210.104] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.104] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29680) returned 0x10ab [0210.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0210.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B335D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b335d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0210.105] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0210.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0210.105] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0210.191] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xc4, lpOverlapped=0x0) returned 1 [0210.192] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xd0, lpOverlapped=0x0) returned 1 [0210.193] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.214] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.225] CloseHandle (hObject=0x108) returned 1 [0210.225] CloseHandle (hObject=0x104) returned 1 [0210.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B335D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b335d.txt")) returned 0 [0210.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B335D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b335d.txt")) returned 0x2020 [0210.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 0x325058 [0210.227] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 0 [0210.227] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0210.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 1 [0210.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 0xffffffff [0210.228] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 1 [0210.228] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0210.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0210.228] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29af4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0210.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29af4) returned 0x10ab [0210.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0210.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B345D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b345d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0210.229] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21f [0210.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0210.230] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0210.307] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x21f, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x21f, lpOverlapped=0x0) returned 1 [0210.308] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x220, lpOverlapped=0x0) returned 1 [0210.309] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.332] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.344] CloseHandle (hObject=0x104) returned 1 [0210.344] CloseHandle (hObject=0x108) returned 1 [0210.344] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B345D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b345d.txt")) returned 0 [0210.345] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40676F6F676C655B345D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40676f6f676c655b345d.txt")) returned 0x2020 [0210.345] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 0x325058 [0210.345] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 0 [0210.345] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0210.345] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 1 [0210.346] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 0xffffffff [0210.346] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 1 [0210.347] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0210.347] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.347] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0210.347] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0210.347] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0210.347] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.347] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0210.347] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0210.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0210.348] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406C696E6B6564696E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406c696e6b6564696e5b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0210.348] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0210.348] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0210.349] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0210.451] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x110, lpOverlapped=0x0) returned 1 [0210.459] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x120, lpOverlapped=0x0) returned 1 [0210.460] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.482] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.493] CloseHandle (hObject=0x108) returned 1 [0210.493] CloseHandle (hObject=0x104) returned 1 [0210.493] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406C696E6B6564696E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406c696e6b6564696e5b315d.txt")) returned 0 [0210.493] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406C696E6B6564696E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406c696e6b6564696e5b315d.txt")) returned 0x2020 [0210.493] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 0x325058 [0210.494] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 0 [0210.494] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0210.494] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 1 [0210.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 0xffffffff [0210.495] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 1 [0210.495] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0210.495] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.495] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0210.495] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0210.495] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0e0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0210.495] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.495] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0e0) returned 0x10ab [0210.495] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0210.496] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0210.496] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406D2E657861637461675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406d2e657861637461675b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0210.496] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76 [0210.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0210.497] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0210.582] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x76, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x76, lpOverlapped=0x0) returned 1 [0210.583] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x80, lpOverlapped=0x0) returned 1 [0210.584] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.606] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.617] CloseHandle (hObject=0x104) returned 1 [0210.617] CloseHandle (hObject=0x108) returned 1 [0210.617] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406D2E657861637461675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406d2e657861637461675b315d.txt")) returned 0 [0210.618] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406D2E657861637461675B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406d2e657861637461675b315d.txt")) returned 0x2020 [0210.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 0x325058 [0210.618] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 0 [0210.618] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0210.618] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 1 [0210.619] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 0xffffffff [0210.619] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 1 [0210.619] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0210.619] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.619] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0210.619] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29300, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0210.619] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.619] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29300) returned 0x10ab [0210.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0210.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406D736E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406d736e5b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0210.625] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x337 [0210.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0210.626] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0210.712] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x337, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x337, lpOverlapped=0x0) returned 1 [0210.714] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x340, lpOverlapped=0x0) returned 1 [0210.715] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.737] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.747] CloseHandle (hObject=0x108) returned 1 [0210.747] CloseHandle (hObject=0x104) returned 1 [0210.747] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406D736E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406d736e5b315d.txt")) returned 0 [0210.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A406D736E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a406d736e5b315d.txt")) returned 0x2020 [0210.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 0x325058 [0210.749] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 0 [0210.749] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0210.749] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 1 [0210.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 0xffffffff [0210.750] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0210.750] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0210.750] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.750] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0210.750] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29794, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0210.750] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.750] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29794) returned 0x10ab [0210.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0210.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4073636F72656361726472657365617263685B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4073636f72656361726472657365617263685b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0210.751] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0210.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0210.752] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0210.834] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xce, lpOverlapped=0x0) returned 1 [0210.835] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xd0, lpOverlapped=0x0) returned 1 [0210.835] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.858] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.868] CloseHandle (hObject=0x104) returned 1 [0210.868] CloseHandle (hObject=0x108) returned 1 [0210.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4073636F72656361726472657365617263685B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4073636f72656361726472657365617263685b325d.txt")) returned 0 [0210.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A4073636F72656361726472657365617263685B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a4073636f72656361726472657365617263685b325d.txt")) returned 0x2020 [0210.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0x325058 [0210.869] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0 [0210.869] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0210.869] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 1 [0210.870] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 0xffffffff [0210.870] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 1 [0210.871] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0210.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0210.871] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0210.871] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afc8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0210.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afc8) returned 0x10ab [0210.871] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0210.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0210.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407365727665722E6164666F726D6473705B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407365727665722e6164666f726d6473705b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0210.872] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c [0210.872] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0210.873] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0210.960] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x6c, lpOverlapped=0x0) returned 1 [0210.961] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x70, lpOverlapped=0x0) returned 1 [0210.962] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.983] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.994] CloseHandle (hObject=0x108) returned 1 [0210.994] CloseHandle (hObject=0x104) returned 1 [0210.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407365727665722E6164666F726D6473705B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407365727665722e6164666f726d6473705b315d.txt")) returned 0 [0210.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407365727665722E6164666F726D6473705B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407365727665722e6164666f726d6473705b315d.txt")) returned 0x2020 [0210.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 0x325058 [0210.995] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 0 [0210.995] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0210.995] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 1 [0210.996] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 0xffffffff [0210.996] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 1 [0210.997] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0210.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0210.997] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29274, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0210.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0210.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29274) returned 0x10ab [0210.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0210.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40736B61647465635B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40736b61647465635b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0210.998] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68 [0210.998] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0210.998] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0211.083] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x68, lpOverlapped=0x0) returned 1 [0211.084] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x70, lpOverlapped=0x0) returned 1 [0211.085] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.109] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.120] CloseHandle (hObject=0x104) returned 1 [0211.120] CloseHandle (hObject=0x108) returned 1 [0211.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40736B61647465635B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40736b61647465635b315d.txt")) returned 0 [0211.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40736B61647465635B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40736b61647465635b315d.txt")) returned 0x2020 [0211.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 0x325058 [0211.121] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 0 [0211.121] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0211.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 1 [0211.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 0xffffffff [0211.123] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 1 [0211.123] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0211.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0211.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af30, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0211.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af30) returned 0x10ab [0211.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0211.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40747261636B2E6164666F726D5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40747261636b2e6164666f726d5b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0211.124] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0211.124] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0211.125] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0211.211] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xb2, lpOverlapped=0x0) returned 1 [0211.212] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xc0, lpOverlapped=0x0) returned 1 [0211.213] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.235] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.246] CloseHandle (hObject=0x108) returned 1 [0211.246] CloseHandle (hObject=0x104) returned 1 [0211.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40747261636B2E6164666F726D5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40747261636b2e6164666f726d5b325d.txt")) returned 0 [0211.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A40747261636B2E6164666F726D5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a40747261636b2e6164666f726d5b325d.txt")) returned 0x2020 [0211.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 0x325058 [0211.248] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 0 [0211.248] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0211.248] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 1 [0211.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 0xffffffff [0211.249] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 1 [0211.249] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0211.249] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.249] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0211.249] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29b1c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0211.249] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.249] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29b1c) returned 0x10ab [0211.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0211.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E62696E675B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e62696e675b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0211.251] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0211.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0211.251] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0211.330] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xd7, lpOverlapped=0x0) returned 1 [0211.331] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xe0, lpOverlapped=0x0) returned 1 [0211.332] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.354] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.365] CloseHandle (hObject=0x104) returned 1 [0211.365] CloseHandle (hObject=0x108) returned 1 [0211.365] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E62696E675B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e62696e675b325d.txt")) returned 0 [0211.366] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E62696E675B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e62696e675b325d.txt")) returned 0x2020 [0211.366] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 0x325058 [0211.366] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 0 [0211.366] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0211.366] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 1 [0211.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 0xffffffff [0211.367] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 1 [0211.367] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0211.368] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.368] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0211.368] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0211.368] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0211.368] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.368] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0f0) returned 0x10ab [0211.368] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0211.368] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0211.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E6C696E6B6564696E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e6c696e6b6564696e5b315d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0211.369] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9 [0211.369] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0211.369] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0211.460] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xa9, lpOverlapped=0x0) returned 1 [0211.461] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xb0, lpOverlapped=0x0) returned 1 [0211.462] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.484] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.494] CloseHandle (hObject=0x108) returned 1 [0211.494] CloseHandle (hObject=0x104) returned 1 [0211.495] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E6C696E6B6564696E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e6c696e6b6564696e5b315d.txt")) returned 0 [0211.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E6C696E6B6564696E5B315D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e6c696e6b6564696e5b315d.txt")) returned 0x2020 [0211.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 0x325058 [0211.496] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 0 [0211.496] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0211.496] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 1 [0211.496] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 0xffffffff [0211.497] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 1 [0211.497] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0211.497] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.497] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0211.497] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0211.498] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0211.498] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.498] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0211.498] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0211.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0211.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E6D736E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e6d736e5b325d.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0211.499] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x402 [0211.499] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0211.499] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0211.592] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x402, lpOverlapped=0x0) returned 1 [0211.602] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x410, lpOverlapped=0x0) returned 1 [0211.603] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.625] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.636] CloseHandle (hObject=0x104) returned 1 [0211.636] CloseHandle (hObject=0x108) returned 1 [0211.636] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E6D736E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e6d736e5b325d.txt")) returned 0 [0211.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\3570356E72676A6E306A735F68616C706D63787A407777772E6D736E5B325D.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\3570356e72676a6e306a735f68616c706d63787a407777772e6d736e5b325d.txt")) returned 0x2020 [0211.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0x325058 [0211.638] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0 [0211.638] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0211.638] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 1 [0211.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 0xffffffff [0211.639] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="index.dat", cAlternateFileName="")) returned 1 [0211.640] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0211.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0211.640] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29274, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0211.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29274) returned 0x10ab [0211.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0211.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0211.641] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0211.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0211.641] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0211.727] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x8000, lpOverlapped=0x0) returned 1 [0211.729] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x8010, lpOverlapped=0x0) returned 1 [0211.730] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.753] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.763] CloseHandle (hObject=0x108) returned 1 [0211.763] CloseHandle (hObject=0x104) returned 1 [0211.764] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\696e646578.dat")) returned 0 [0211.765] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\696e646578.dat")) returned 0x2020 [0211.765] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325058 [0211.765] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0211.765] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0211.765] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat")) returned 1 [0211.766] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat")) returned 0xffffffff [0211.766] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="index.dat", cAlternateFileName="")) returned 0 [0211.766] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0211.766] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0211.766] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0211.766] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0211.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0211.767] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="..", cAlternateFileName="")) returned 1 [0211.767] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Low", cAlternateFileName="")) returned 1 [0211.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0211.767] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.767] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.767] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0211.767] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Low", cAlternateFileName="")) returned 0 [0211.767] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0211.767] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0211.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0211.767] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="..", cAlternateFileName="")) returned 1 [0211.767] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="index.dat", cAlternateFileName="")) returned 1 [0211.768] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0211.768] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.768] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0211.768] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0211.768] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.768] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae48) returned 0x10ab [0211.768] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.768] CloseHandle (hObject=0xffffffff) returned 0 [0211.768] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\696e646578.dat")) returned 0 [0211.768] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\696e646578.dat")) returned 0xffffffff [0211.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325018 [0211.769] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0211.769] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0211.769] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 0 [0211.769] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 0x2026 [0211.769] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.769] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x335f48, cFileName=".", cAlternateFileName="")) returned 0x325018 [0211.769] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x335f48, cFileName="..", cAlternateFileName="")) returned 1 [0211.769] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xaa00a8, dwReserved1=0x335f48, cFileName="index.dat", cAlternateFileName="")) returned 1 [0211.769] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0211.769] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.769] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0211.769] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2974c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0211.769] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.770] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2974c) returned 0x10ab [0211.770] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0211.770] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0211.771] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40000 [0211.771] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0211.771] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0211.842] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x40000, lpOverlapped=0x0) returned 1 [0211.849] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x40010, lpOverlapped=0x0) returned 1 [0211.854] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.877] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.888] CloseHandle (hObject=0x104) returned 1 [0211.888] CloseHandle (hObject=0x108) returned 1 [0211.888] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\696e646578.dat")) returned 0 [0211.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\696e646578.dat")) returned 0x2020 [0211.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325058 [0211.889] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0211.889] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0211.889] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat")) returned 1 [0211.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat")) returned 0xffffffff [0211.891] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xaa00a8, dwReserved1=0x335f48, cFileName="index.dat", cAlternateFileName="")) returned 0 [0211.891] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0211.891] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0211.891] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0211.891] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0211.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0211.891] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.891] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0211.892] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0211.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0211.892] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aef8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0211.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0211.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aef8) returned 0x10ab [0211.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0211.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0211.894] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0211.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0211.894] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0211.991] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x112, lpOverlapped=0x0) returned 1 [0211.992] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0211.993] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.015] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.026] CloseHandle (hObject=0x10c) returned 1 [0212.026] CloseHandle (hObject=0x108) returned 1 [0212.026] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\6465736b746f70.ini")) returned 0 [0212.027] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\6465736b746f70.ini")) returned 0x2020 [0212.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0212.027] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0212.027] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0212.028] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 1 [0212.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 0xffffffff [0212.028] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0212.029] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.029] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.029] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.029] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.029] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.029] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.029] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b4) returned 0x10ab [0212.029] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.030] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0212.030] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.030] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.030] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b4) returned 0x10ab [0212.030] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.031] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0212.031] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.031] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.031] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b4) returned 0x10ab [0212.031] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.032] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0212.032] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.032] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.032] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.032] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.032] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.032] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.032] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b4) returned 0x10ab [0212.032] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.033] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0212.033] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0212.033] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0212.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0212.033] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 1 [0212.033] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 0 [0212.033] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0212.033] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0212.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0212.034] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 1 [0212.034] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 0 [0212.034] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0212.034] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0212.034] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0212.034] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 1 [0212.034] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="index.dat", cAlternateFileName="")) returned 1 [0212.035] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.035] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.035] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.035] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.035] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.035] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.035] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b4) returned 0x10ab [0212.035] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0212.037] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0212.037] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0212.037] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0212.038] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0212.123] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x8000, lpOverlapped=0x0) returned 1 [0212.125] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x8010, lpOverlapped=0x0) returned 1 [0212.126] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.148] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.159] CloseHandle (hObject=0x108) returned 1 [0212.159] CloseHandle (hObject=0x10c) returned 1 [0212.159] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\696e646578.dat")) returned 0 [0212.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\696e646578.dat")) returned 0x2020 [0212.160] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325018 [0212.160] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0212.160] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0212.160] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")) returned 1 [0212.161] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")) returned 0xffffffff [0212.161] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0212.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa600a4, dwReserved1=0x326f20, cFileName=".", cAlternateFileName="")) returned 0x325018 [0212.162] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa600a4, dwReserved1=0x326f20, cFileName="..", cAlternateFileName="")) returned 1 [0212.162] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xa600a4, dwReserved1=0x326f20, cFileName="index.dat", cAlternateFileName="")) returned 1 [0212.162] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.162] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.162] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.162] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.163] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.163] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.163] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0212.163] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0212.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\696e646578.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0212.164] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c000 [0212.164] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0212.164] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0212.251] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1c000, lpOverlapped=0x0) returned 1 [0212.254] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1c010, lpOverlapped=0x0) returned 1 [0212.257] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.288] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.299] CloseHandle (hObject=0x108) returned 1 [0212.299] CloseHandle (hObject=0x104) returned 1 [0212.299] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\696e646578.dat")) returned 0 [0212.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\696E646578.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\696e646578.dat")) returned 0x2020 [0212.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0x325058 [0212.300] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0212.300] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0212.301] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat")) returned 1 [0212.302] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat")) returned 0xffffffff [0212.302] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xa600a4, dwReserved1=0x326f20, cFileName="index.dat", cAlternateFileName="")) returned 0 [0212.302] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0212.302] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0212.302] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0212.302] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Recent", cAlternateFileName="")) returned 1 [0212.302] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0212.302] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.303] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2602c10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e317b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e317b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16XXq 5rfX.lnk", cAlternateFileName="16XXQ5~1.LNK")) returned 1 [0212.303] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.303] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.303] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.303] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af40, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.303] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.303] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af40) returned 0x10ab [0212.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\16XXq 5rfX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\16xxq 5rfx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0212.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31365858712035726658.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31365858712035726658.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0212.305] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6f [0212.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0212.305] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0212.377] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe6f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe6f, lpOverlapped=0x0) returned 1 [0212.378] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xe70, lpOverlapped=0x0) returned 1 [0212.379] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.421] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.432] CloseHandle (hObject=0x10c) returned 1 [0212.432] CloseHandle (hObject=0x104) returned 1 [0212.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\16XXq 5rfX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\16xxq 5rfx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31365858712035726658.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31365858712035726658.lnk")) returned 0 [0212.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31365858712035726658.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31365858712035726658.lnk")) returned 0x20 [0212.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\16XXq 5rfX.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2602c10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e317b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e317b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe6f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="16XXq 5rfX.lnk", cAlternateFileName="16XXQ5~1.LNK")) returned 0x325018 [0212.434] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2602c10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e317b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e317b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe6f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="16XXq 5rfX.lnk", cAlternateFileName="16XXQ5~1.LNK")) returned 0 [0212.434] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0212.434] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\16XXq 5rfX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\16xxq 5rfx.lnk")) returned 1 [0212.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\16XXq 5rfX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\16xxq 5rfx.lnk")) returned 0xffffffff [0212.435] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29bae70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29bae70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29bae70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="1YI5ld05XHrT.flv.lnk", cAlternateFileName="1YI5LD~1.LNK")) returned 1 [0212.435] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.435] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.435] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.435] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.436] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.436] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.436] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0212.436] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1YI5ld05XHrT.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1yi5ld05xhrt.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0212.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\315949356C643035584872542E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\315949356c643035584872542e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0212.437] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x384 [0212.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0212.438] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0212.512] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x384, lpOverlapped=0x0) returned 1 [0212.513] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x390, lpOverlapped=0x0) returned 1 [0212.514] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.537] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.548] CloseHandle (hObject=0x104) returned 1 [0212.548] CloseHandle (hObject=0x10c) returned 1 [0212.548] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1YI5ld05XHrT.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1yi5ld05xhrt.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\315949356C643035584872542E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\315949356c643035584872542e666c76.lnk")) returned 0 [0212.549] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\315949356C643035584872542E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\315949356c643035584872542e666c76.lnk")) returned 0x20 [0212.549] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1YI5ld05XHrT.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29bae70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29bae70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29bae70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="1YI5ld05XHrT.flv.lnk", cAlternateFileName="1YI5LD~1.LNK")) returned 0x325018 [0212.549] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29bae70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29bae70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29bae70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="1YI5ld05XHrT.flv.lnk", cAlternateFileName="1YI5LD~1.LNK")) returned 0 [0212.549] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0212.549] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1YI5ld05XHrT.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1yi5ld05xhrt.flv.lnk")) returned 1 [0212.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1YI5ld05XHrT.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1yi5ld05xhrt.flv.lnk")) returned 0xffffffff [0212.550] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="2bRj0vbpKkMdZ6t68.flv.lnk", cAlternateFileName="2BRJ0V~1.LNK")) returned 1 [0212.551] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.551] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.551] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.551] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.551] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b08c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.551] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.551] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b08c) returned 0x10ab [0212.552] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2bRj0vbpKkMdZ6t68.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2brj0vbpkkmdz6t68.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0212.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3262526A307662704B6B4D645A367436382E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3262526a307662704b6b4d645a367436382e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0212.553] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266 [0212.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0212.553] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0212.641] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x266, lpOverlapped=0x0) returned 1 [0212.642] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x270, lpOverlapped=0x0) returned 1 [0212.643] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.666] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.677] CloseHandle (hObject=0x10c) returned 1 [0212.677] CloseHandle (hObject=0x104) returned 1 [0212.677] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2bRj0vbpKkMdZ6t68.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2brj0vbpkkmdz6t68.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3262526A307662704B6B4D645A367436382E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3262526a307662704b6b4d645a367436382e666c76.lnk")) returned 0 [0212.678] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3262526A307662704B6B4D645A367436382E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3262526a307662704b6b4d645a367436382e666c76.lnk")) returned 0x20 [0212.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2bRj0vbpKkMdZ6t68.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2bRj0vbpKkMdZ6t68.flv.lnk", cAlternateFileName="2BRJ0V~1.LNK")) returned 0x325018 [0212.678] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2bRj0vbpKkMdZ6t68.flv.lnk", cAlternateFileName="2BRJ0V~1.LNK")) returned 0 [0212.678] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0212.678] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2bRj0vbpKkMdZ6t68.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2brj0vbpkkmdz6t68.flv.lnk")) returned 1 [0212.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2bRj0vbpKkMdZ6t68.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2brj0vbpkkmdz6t68.flv.lnk")) returned 0xffffffff [0212.679] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b11ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b11ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b11ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="2DcktVM.mkv.lnk", cAlternateFileName="2DCKTV~1.LNK")) returned 1 [0212.680] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.680] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.680] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.680] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.680] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.680] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.680] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0212.680] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.680] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2DcktVM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2dcktvm.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0212.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3244636B74564D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3244636b74564d2e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0212.682] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e1 [0212.682] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0212.682] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0212.770] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3e1, lpOverlapped=0x0) returned 1 [0212.771] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0212.772] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.794] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.805] CloseHandle (hObject=0x104) returned 1 [0212.805] CloseHandle (hObject=0x10c) returned 1 [0212.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2DcktVM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2dcktvm.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3244636B74564D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3244636b74564d2e6d6b76.lnk")) returned 0 [0212.806] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3244636B74564D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3244636b74564d2e6d6b76.lnk")) returned 0x20 [0212.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2DcktVM.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b11ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b11ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b11ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2DcktVM.mkv.lnk", cAlternateFileName="2DCKTV~1.LNK")) returned 0x325018 [0212.806] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b11ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b11ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b11ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2DcktVM.mkv.lnk", cAlternateFileName="2DCKTV~1.LNK")) returned 0 [0212.806] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0212.806] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2DcktVM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2dcktvm.mkv.lnk")) returned 1 [0212.807] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2DcktVM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2dcktvm.mkv.lnk")) returned 0xffffffff [0212.807] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f50e30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f50e30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f50e30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="2mh1.lnk", cAlternateFileName="")) returned 1 [0212.808] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.808] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.808] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.808] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.808] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.808] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae44) returned 0x10ab [0212.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2mh1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2mh1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0212.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\326D6831.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\326d6831.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0212.809] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f1 [0212.809] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0212.810] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0212.883] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9f1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9f1, lpOverlapped=0x0) returned 1 [0212.884] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0212.885] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.907] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.920] CloseHandle (hObject=0x10c) returned 1 [0212.920] CloseHandle (hObject=0x104) returned 1 [0212.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2mh1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2mh1.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\326D6831.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\326d6831.lnk")) returned 0 [0212.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\326D6831.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\326d6831.lnk")) returned 0x20 [0212.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2mh1.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f50e30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f50e30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f50e30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2mh1.lnk", cAlternateFileName="")) returned 0x325018 [0212.921] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f50e30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f50e30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f50e30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2mh1.lnk", cAlternateFileName="")) returned 0 [0212.921] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0212.921] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2mh1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2mh1.lnk")) returned 1 [0212.922] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2mh1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2mh1.lnk")) returned 0xffffffff [0212.922] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f3c150, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x14dc, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="2YFN3Eu7G N6GsxWsubh.ots.lnk", cAlternateFileName="2YFN3E~1.LNK")) returned 1 [0212.923] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0212.923] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.923] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0212.923] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0212.923] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0212.923] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0212.923] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0212.923] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0212.924] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YFN3Eu7G N6GsxWsubh.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2yfn3eu7g n6gsxwsubh.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0212.924] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3259464E3345753747204E3647737857737562682E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3259464e3345753747204e3647737857737562682e6f7473.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0212.925] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14dc [0212.925] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0212.925] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0213.013] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14dc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x14dc, lpOverlapped=0x0) returned 1 [0213.014] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x14e0, lpOverlapped=0x0) returned 1 [0213.022] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.046] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.056] CloseHandle (hObject=0x104) returned 1 [0213.056] CloseHandle (hObject=0x10c) returned 1 [0213.059] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YFN3Eu7G N6GsxWsubh.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2yfn3eu7g n6gsxwsubh.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3259464E3345753747204E3647737857737562682E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3259464e3345753747204e3647737857737562682e6f7473.lnk")) returned 0 [0213.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3259464E3345753747204E3647737857737562682E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3259464e3345753747204e3647737857737562682e6f7473.lnk")) returned 0x20 [0213.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YFN3Eu7G N6GsxWsubh.ots.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f3c150, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x14dc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2YFN3Eu7G N6GsxWsubh.ots.lnk", cAlternateFileName="2YFN3E~1.LNK")) returned 0x325018 [0213.061] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f3c150, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x14dc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2YFN3Eu7G N6GsxWsubh.ots.lnk", cAlternateFileName="2YFN3E~1.LNK")) returned 0 [0213.061] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0213.061] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YFN3Eu7G N6GsxWsubh.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2yfn3eu7g n6gsxwsubh.ots.lnk")) returned 1 [0213.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YFN3Eu7G N6GsxWsubh.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2yfn3eu7g n6gsxwsubh.ots.lnk")) returned 0xffffffff [0213.062] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa136a030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa136a030, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa136a030, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="44KQs5EVMXuZ.lnk", cAlternateFileName="44KQS5~1.LNK")) returned 1 [0213.063] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0213.063] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.063] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0213.063] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0213.063] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b084, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0213.063] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.064] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b084) returned 0x10ab [0213.064] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0213.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\44KQs5EVMXuZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\44kqs5evmxuz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0213.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\34344B51733545564D58755A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\34344b51733545564d58755a.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0213.065] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef7 [0213.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0213.066] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0213.153] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xef7, lpOverlapped=0x0) returned 1 [0213.154] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf00, lpOverlapped=0x0) returned 1 [0213.155] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.177] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.188] CloseHandle (hObject=0x10c) returned 1 [0213.188] CloseHandle (hObject=0x104) returned 1 [0213.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\44KQs5EVMXuZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\44kqs5evmxuz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\34344B51733545564D58755A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\34344b51733545564d58755a.lnk")) returned 0 [0213.189] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\34344B51733545564D58755A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\34344b51733545564d58755a.lnk")) returned 0x20 [0213.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\44KQs5EVMXuZ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa136a030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa136a030, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa136a030, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="44KQs5EVMXuZ.lnk", cAlternateFileName="44KQS5~1.LNK")) returned 0x325018 [0213.189] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa136a030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa136a030, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa136a030, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="44KQs5EVMXuZ.lnk", cAlternateFileName="44KQS5~1.LNK")) returned 0 [0213.189] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0213.189] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\44KQs5EVMXuZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\44kqs5evmxuz.lnk")) returned 1 [0213.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\44KQs5EVMXuZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\44kqs5evmxuz.lnk")) returned 0xffffffff [0213.190] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa237b4b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa237b4b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa237b4b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="4EE4dVh2B.lnk", cAlternateFileName="4EE4DV~1.LNK")) returned 1 [0213.191] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0213.191] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.191] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0213.191] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0213.191] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0213.192] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.192] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0213.192] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0213.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4EE4dVh2B.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4ee4dvh2b.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0213.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\344545346456683242.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\344545346456683242.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0213.193] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0c [0213.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0213.193] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0213.281] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa0c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa0c, lpOverlapped=0x0) returned 1 [0213.282] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa10, lpOverlapped=0x0) returned 1 [0213.283] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.314] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.325] CloseHandle (hObject=0x104) returned 1 [0213.325] CloseHandle (hObject=0x10c) returned 1 [0213.325] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4EE4dVh2B.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4ee4dvh2b.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\344545346456683242.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\344545346456683242.lnk")) returned 0 [0213.326] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\344545346456683242.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\344545346456683242.lnk")) returned 0x20 [0213.326] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4EE4dVh2B.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa237b4b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa237b4b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa237b4b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa0c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4EE4dVh2B.lnk", cAlternateFileName="4EE4DV~1.LNK")) returned 0x325018 [0213.326] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa237b4b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa237b4b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa237b4b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa0c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4EE4dVh2B.lnk", cAlternateFileName="4EE4DV~1.LNK")) returned 0 [0213.326] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0213.326] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4EE4dVh2B.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4ee4dvh2b.lnk")) returned 1 [0213.327] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4EE4dVh2B.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4ee4dvh2b.lnk")) returned 0xffffffff [0213.327] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bd01b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bd01b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bd01b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x0, dwReserved1=0x0, cFileName="5asd3AVG1.lnk", cAlternateFileName="5ASD3A~1.LNK")) returned 1 [0213.328] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0213.328] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.328] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0213.328] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0213.328] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aff8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0213.328] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.329] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aff8) returned 0x10ab [0213.329] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0213.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5asd3AVG1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5asd3avg1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0213.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\356173643341564731.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\356173643341564731.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0213.330] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x375 [0213.330] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0213.330] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0213.422] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x375, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x375, lpOverlapped=0x0) returned 1 [0213.423] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x380, lpOverlapped=0x0) returned 1 [0213.423] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.445] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.456] CloseHandle (hObject=0x10c) returned 1 [0213.456] CloseHandle (hObject=0x104) returned 1 [0213.457] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5asd3AVG1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5asd3avg1.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\356173643341564731.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\356173643341564731.lnk")) returned 0 [0213.457] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\356173643341564731.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\356173643341564731.lnk")) returned 0x20 [0213.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5asd3AVG1.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bd01b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bd01b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bd01b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5asd3AVG1.lnk", cAlternateFileName="5ASD3A~1.LNK")) returned 0x325018 [0213.458] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bd01b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bd01b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bd01b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5asd3AVG1.lnk", cAlternateFileName="5ASD3A~1.LNK")) returned 0 [0213.458] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0213.458] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5asd3AVG1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5asd3avg1.lnk")) returned 1 [0213.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5asd3AVG1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5asd3avg1.lnk")) returned 0xffffffff [0213.459] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f15ff0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f15ff0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f15ff0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="5c2wSx_Gnv.lnk", cAlternateFileName="5C2WSX~1.LNK")) returned 1 [0213.459] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0213.459] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.459] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0213.459] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0213.460] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0213.460] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.460] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0ac) returned 0x10ab [0213.460] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0213.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5c2wSx_Gnv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5c2wsx_gnv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0213.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3563327753785F476E76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3563327753785f476e76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0213.461] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1b [0213.461] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0213.461] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0213.550] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa1b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa1b, lpOverlapped=0x0) returned 1 [0213.550] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0213.551] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.574] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.584] CloseHandle (hObject=0x104) returned 1 [0213.584] CloseHandle (hObject=0x10c) returned 1 [0213.584] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5c2wSx_Gnv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5c2wsx_gnv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3563327753785F476E76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3563327753785f476e76.lnk")) returned 0 [0213.585] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3563327753785F476E76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3563327753785f476e76.lnk")) returned 0x20 [0213.585] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5c2wSx_Gnv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f15ff0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f15ff0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f15ff0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5c2wSx_Gnv.lnk", cAlternateFileName="5C2WSX~1.LNK")) returned 0x325018 [0213.585] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f15ff0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f15ff0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f15ff0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5c2wSx_Gnv.lnk", cAlternateFileName="5C2WSX~1.LNK")) returned 0 [0213.585] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0213.586] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5c2wSx_Gnv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5c2wsx_gnv.lnk")) returned 1 [0213.586] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5c2wSx_Gnv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5c2wsx_gnv.lnk")) returned 0xffffffff [0213.586] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2948a50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2948a50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2948a50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="6l-91qpt fGJ.flv.lnk", cAlternateFileName="6L-91Q~1.LNK")) returned 1 [0213.587] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0213.595] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.595] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0213.595] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aee0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0213.596] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.596] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aee0) returned 0x10ab [0213.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6l-91qpt fGJ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6l-91qpt fgj.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0213.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\366C2D39317170742066474A2E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\366c2d39317170742066474a2e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0213.597] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fc [0213.597] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0213.598] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0213.685] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3fc, lpOverlapped=0x0) returned 1 [0213.685] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x400, lpOverlapped=0x0) returned 1 [0213.686] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.708] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.719] CloseHandle (hObject=0x10c) returned 1 [0213.719] CloseHandle (hObject=0x104) returned 1 [0213.719] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6l-91qpt fGJ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6l-91qpt fgj.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\366C2D39317170742066474A2E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\366c2d39317170742066474a2e666c76.lnk")) returned 0 [0213.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\366C2D39317170742066474A2E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\366c2d39317170742066474a2e666c76.lnk")) returned 0x20 [0213.720] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6l-91qpt fGJ.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2948a50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2948a50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2948a50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="6l-91qpt fGJ.flv.lnk", cAlternateFileName="6L-91Q~1.LNK")) returned 0x325018 [0213.720] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2948a50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2948a50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2948a50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="6l-91qpt fGJ.flv.lnk", cAlternateFileName="6L-91Q~1.LNK")) returned 0 [0213.720] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0213.721] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6l-91qpt fGJ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6l-91qpt fgj.flv.lnk")) returned 1 [0213.721] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6l-91qpt fGJ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6l-91qpt fgj.flv.lnk")) returned 0xffffffff [0213.721] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1c572b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1c572b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Az7ockjbPGK3l6ZUP.lnk", cAlternateFileName="7AZ7OC~1.LNK")) returned 1 [0213.722] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0213.722] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.722] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0213.722] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0213.722] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0213.722] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.722] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0213.723] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0213.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Az7ockjbPGK3l6ZUP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7az7ockjbpgk3l6zup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0213.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37417A376F636B6A6250474B336C365A5550.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37417a376f636b6a6250474b336c365a5550.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0213.724] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26b [0213.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0213.724] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0213.811] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x26b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x26b, lpOverlapped=0x0) returned 1 [0213.811] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x270, lpOverlapped=0x0) returned 1 [0213.812] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.834] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.845] CloseHandle (hObject=0x104) returned 1 [0213.846] CloseHandle (hObject=0x10c) returned 1 [0213.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Az7ockjbPGK3l6ZUP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7az7ockjbpgk3l6zup.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37417A376F636B6A6250474B336C365A5550.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37417a376f636b6a6250474b336c365a5550.lnk")) returned 0 [0213.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37417A376F636B6A6250474B336C365A5550.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37417a376f636b6a6250474b336c365a5550.lnk")) returned 0x20 [0213.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Az7ockjbPGK3l6ZUP.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1c572b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1c572b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7Az7ockjbPGK3l6ZUP.lnk", cAlternateFileName="7AZ7OC~1.LNK")) returned 0x325018 [0213.847] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1c572b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1c572b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7Az7ockjbPGK3l6ZUP.lnk", cAlternateFileName="7AZ7OC~1.LNK")) returned 0 [0213.847] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0213.847] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Az7ockjbPGK3l6ZUP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7az7ockjbpgk3l6zup.lnk")) returned 1 [0213.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Az7ockjbPGK3l6ZUP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7az7ockjbpgk3l6zup.lnk")) returned 0xffffffff [0213.848] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2dbf390, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2dbf390, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2dbf390, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7C-aFh QQPi3zN6R9eF.lnk", cAlternateFileName="7C-AFH~1.LNK")) returned 1 [0213.848] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0213.848] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.848] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0213.848] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0213.849] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b088, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0213.849] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.849] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b088) returned 0x10ab [0213.849] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0213.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7C-aFh QQPi3zN6R9eF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7c-afh qqpi3zn6r9ef.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0213.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37432D6146682051515069337A4E3652396546.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37432d6146682051515069337a4e3652396546.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0213.850] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7a [0213.850] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0213.850] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0213.938] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa7a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa7a, lpOverlapped=0x0) returned 1 [0213.939] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa80, lpOverlapped=0x0) returned 1 [0213.940] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.963] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.974] CloseHandle (hObject=0x10c) returned 1 [0213.974] CloseHandle (hObject=0x104) returned 1 [0213.974] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7C-aFh QQPi3zN6R9eF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7c-afh qqpi3zn6r9ef.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37432D6146682051515069337A4E3652396546.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37432d6146682051515069337a4e3652396546.lnk")) returned 0 [0213.975] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37432D6146682051515069337A4E3652396546.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37432d6146682051515069337a4e3652396546.lnk")) returned 0x20 [0213.975] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7C-aFh QQPi3zN6R9eF.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2dbf390, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2dbf390, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2dbf390, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7C-aFh QQPi3zN6R9eF.lnk", cAlternateFileName="7C-AFH~1.LNK")) returned 0x325018 [0213.975] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2dbf390, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2dbf390, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2dbf390, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7C-aFh QQPi3zN6R9eF.lnk", cAlternateFileName="7C-AFH~1.LNK")) returned 0 [0213.975] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0213.975] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7C-aFh QQPi3zN6R9eF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7c-afh qqpi3zn6r9ef.lnk")) returned 1 [0213.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7C-aFh QQPi3zN6R9eF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7c-afh qqpi3zn6r9ef.lnk")) returned 0xffffffff [0213.976] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d26e10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d26e10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d26e10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7GqmO5rhL8u9kc5ml-.lnk", cAlternateFileName="7GQMO5~1.LNK")) returned 1 [0213.977] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0213.977] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.977] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0213.977] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0213.977] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0213.977] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0213.977] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0213.977] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0213.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7GqmO5rhL8u9kc5ml-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7gqmo5rhl8u9kc5ml-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0213.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3747716D4F3572684C3875396B63356D6C2D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3747716d4f3572684c3875396b63356d6c2d.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0213.978] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2 [0213.978] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0213.979] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0214.050] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3a2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3a2, lpOverlapped=0x0) returned 1 [0214.051] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3b0, lpOverlapped=0x0) returned 1 [0214.052] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.074] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.085] CloseHandle (hObject=0x104) returned 1 [0214.085] CloseHandle (hObject=0x10c) returned 1 [0214.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7GqmO5rhL8u9kc5ml-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7gqmo5rhl8u9kc5ml-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3747716D4F3572684C3875396B63356D6C2D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3747716d4f3572684c3875396b63356d6c2d.lnk")) returned 0 [0214.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3747716D4F3572684C3875396B63356D6C2D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3747716d4f3572684c3875396b63356d6c2d.lnk")) returned 0x20 [0214.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7GqmO5rhL8u9kc5ml-.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d26e10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d26e10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d26e10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7GqmO5rhL8u9kc5ml-.lnk", cAlternateFileName="7GQMO5~1.LNK")) returned 0x325018 [0214.089] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d26e10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d26e10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d26e10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7GqmO5rhL8u9kc5ml-.lnk", cAlternateFileName="7GQMO5~1.LNK")) returned 0 [0214.089] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0214.089] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7GqmO5rhL8u9kc5ml-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7gqmo5rhl8u9kc5ml-.lnk")) returned 1 [0214.090] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7GqmO5rhL8u9kc5ml-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7gqmo5rhl8u9kc5ml-.lnk")) returned 0xffffffff [0214.091] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16afe70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16afe70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecd, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="7s4pege4mQRn0v.mkv.lnk", cAlternateFileName="7S4PEG~1.LNK")) returned 1 [0214.091] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0214.091] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.091] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0214.091] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0214.091] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0214.091] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.092] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0214.092] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0214.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7s4pege4mQRn0v.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7s4pege4mqrn0v.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0214.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37733470656765346D51526E30762E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37733470656765346d51526e30762e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0214.093] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ecd [0214.093] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0214.093] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0214.180] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ecd, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1ecd, lpOverlapped=0x0) returned 1 [0214.181] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1ed0, lpOverlapped=0x0) returned 1 [0214.182] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.204] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.215] CloseHandle (hObject=0x10c) returned 1 [0214.215] CloseHandle (hObject=0x104) returned 1 [0214.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7s4pege4mQRn0v.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7s4pege4mqrn0v.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37733470656765346D51526E30762E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37733470656765346d51526e30762e6d6b76.lnk")) returned 0 [0214.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\37733470656765346D51526E30762E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\37733470656765346d51526e30762e6d6b76.lnk")) returned 0x20 [0214.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7s4pege4mQRn0v.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16afe70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16afe70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7s4pege4mQRn0v.mkv.lnk", cAlternateFileName="7S4PEG~1.LNK")) returned 0x325018 [0214.216] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16afe70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16afe70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7s4pege4mQRn0v.mkv.lnk", cAlternateFileName="7S4PEG~1.LNK")) returned 0 [0214.216] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0214.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7s4pege4mQRn0v.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7s4pege4mqrn0v.mkv.lnk")) returned 1 [0214.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7s4pege4mQRn0v.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7s4pege4mqrn0v.mkv.lnk")) returned 0xffffffff [0214.218] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d00cb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d00cb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d00cb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="80LrehEN.lnk", cAlternateFileName="")) returned 1 [0214.218] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0214.218] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.218] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0214.218] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0214.218] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b068, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0214.218] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.219] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b068) returned 0x10ab [0214.219] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0214.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\80LrehEN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\80lrehen.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0214.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\38304C726568454E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\38304c726568454e.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0214.220] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa05 [0214.220] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0214.220] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0214.317] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa05, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa05, lpOverlapped=0x0) returned 1 [0214.318] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa10, lpOverlapped=0x0) returned 1 [0214.319] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.341] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.351] CloseHandle (hObject=0x104) returned 1 [0214.351] CloseHandle (hObject=0x10c) returned 1 [0214.352] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\80LrehEN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\80lrehen.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\38304C726568454E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\38304c726568454e.lnk")) returned 0 [0214.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\38304C726568454E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\38304c726568454e.lnk")) returned 0x20 [0214.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\80LrehEN.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d00cb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d00cb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d00cb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="80LrehEN.lnk", cAlternateFileName="")) returned 0x325018 [0214.353] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d00cb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d00cb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d00cb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="80LrehEN.lnk", cAlternateFileName="")) returned 0 [0214.353] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0214.353] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\80LrehEN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\80lrehen.lnk")) returned 1 [0214.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\80LrehEN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\80lrehen.lnk")) returned 0xffffffff [0214.354] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d730d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d730d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d730d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8vKONknDwA.lnk", cAlternateFileName="8VKONK~1.LNK")) returned 1 [0214.354] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0214.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0214.355] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0214.355] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0214.355] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.355] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0214.355] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0214.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vKONknDwA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8vkonkndwa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0214.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\38764B4F4E6B6E447741.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\38764b4f4e6b6e447741.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0214.356] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1b [0214.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0214.357] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0214.446] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa1b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa1b, lpOverlapped=0x0) returned 1 [0214.447] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0214.448] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.470] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.480] CloseHandle (hObject=0x10c) returned 1 [0214.480] CloseHandle (hObject=0x104) returned 1 [0214.480] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vKONknDwA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8vkonkndwa.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\38764B4F4E6B6E447741.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\38764b4f4e6b6e447741.lnk")) returned 0 [0214.481] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\38764B4F4E6B6E447741.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\38764b4f4e6b6e447741.lnk")) returned 0x20 [0214.481] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vKONknDwA.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d730d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d730d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d730d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8vKONknDwA.lnk", cAlternateFileName="8VKONK~1.LNK")) returned 0x325018 [0214.481] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d730d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d730d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d730d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="8vKONknDwA.lnk", cAlternateFileName="8VKONK~1.LNK")) returned 0 [0214.481] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0214.481] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vKONknDwA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8vkonkndwa.lnk")) returned 1 [0214.482] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8vKONknDwA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8vkonkndwa.lnk")) returned 0xffffffff [0214.482] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ec9d30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ec9d30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ec9d30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="9bUheDCUAs1D0.lnk", cAlternateFileName="9BUHED~1.LNK")) returned 1 [0214.483] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0214.483] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.483] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0214.483] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0214.483] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0214.483] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.483] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b8) returned 0x10ab [0214.483] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0214.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9bUheDCUAs1D0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9buhedcuas1d0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0214.484] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39625568654443554173314430.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\39625568654443554173314430.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0214.484] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20ee [0214.484] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0214.485] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0214.572] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x20ee, lpOverlapped=0x0) returned 1 [0214.572] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x20f0, lpOverlapped=0x0) returned 1 [0214.573] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.602] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.613] CloseHandle (hObject=0x104) returned 1 [0214.613] CloseHandle (hObject=0x10c) returned 1 [0214.613] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9bUheDCUAs1D0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9buhedcuas1d0.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39625568654443554173314430.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\39625568654443554173314430.lnk")) returned 0 [0214.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39625568654443554173314430.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\39625568654443554173314430.lnk")) returned 0x20 [0214.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9bUheDCUAs1D0.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ec9d30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ec9d30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ec9d30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9bUheDCUAs1D0.lnk", cAlternateFileName="9BUHED~1.LNK")) returned 0x325018 [0214.614] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ec9d30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ec9d30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ec9d30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9bUheDCUAs1D0.lnk", cAlternateFileName="9BUHED~1.LNK")) returned 0 [0214.614] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0214.614] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9bUheDCUAs1D0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9buhedcuas1d0.lnk")) returned 1 [0214.615] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9bUheDCUAs1D0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9buhedcuas1d0.lnk")) returned 0xffffffff [0214.615] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a2d290, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a2d290, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a2d290, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x211a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9qzNoujUhPYr1ntDw.lnk", cAlternateFileName="9QZNOU~1.LNK")) returned 1 [0214.615] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0214.615] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.615] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0214.615] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aecc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0214.615] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.615] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aecc) returned 0x10ab [0214.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qzNoujUhPYr1ntDw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qznoujuhpyr1ntdw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0214.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39717A4E6F756A5568505972316E744477.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\39717a4e6f756a5568505972316e744477.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0214.616] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x211a [0214.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0214.617] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0214.706] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x211a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x211a, lpOverlapped=0x0) returned 1 [0214.707] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2120, lpOverlapped=0x0) returned 1 [0214.708] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.730] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.741] CloseHandle (hObject=0x10c) returned 1 [0214.741] CloseHandle (hObject=0x104) returned 1 [0214.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qzNoujUhPYr1ntDw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qznoujuhpyr1ntdw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39717A4E6F756A5568505972316E744477.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\39717a4e6f756a5568505972316e744477.lnk")) returned 0 [0214.742] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39717A4E6F756A5568505972316E744477.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\39717a4e6f756a5568505972316e744477.lnk")) returned 0x20 [0214.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qzNoujUhPYr1ntDw.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a2d290, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a2d290, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a2d290, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x211a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9qzNoujUhPYr1ntDw.lnk", cAlternateFileName="9QZNOU~1.LNK")) returned 0x325018 [0214.742] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a2d290, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a2d290, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a2d290, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x211a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9qzNoujUhPYr1ntDw.lnk", cAlternateFileName="9QZNOU~1.LNK")) returned 0 [0214.742] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0214.742] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qzNoujUhPYr1ntDw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qznoujuhpyr1ntdw.lnk")) returned 1 [0214.743] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qzNoujUhPYr1ntDw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qznoujuhpyr1ntdw.lnk")) returned 0xffffffff [0214.743] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2602c10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2602c10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2602c10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="ab48R1oYXYyDTLB_.lnk", cAlternateFileName="AB48R1~1.LNK")) returned 1 [0214.744] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0214.744] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.744] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0214.744] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0214.744] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b038, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0214.744] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.744] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b038) returned 0x10ab [0214.744] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0214.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ab48R1oYXYyDTLB_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ab48r1oyxyydtlb_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0214.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6162343852316F5958597944544C425F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6162343852316f5958597944544c425f.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0214.746] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0214.746] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0214.746] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0214.816] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1499, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1499, lpOverlapped=0x0) returned 1 [0214.817] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x14a0, lpOverlapped=0x0) returned 1 [0214.817] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.840] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.850] CloseHandle (hObject=0x104) returned 1 [0214.850] CloseHandle (hObject=0x10c) returned 1 [0214.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ab48R1oYXYyDTLB_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ab48r1oyxyydtlb_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6162343852316F5958597944544C425F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6162343852316f5958597944544c425f.lnk")) returned 0 [0214.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6162343852316F5958597944544C425F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6162343852316f5958597944544c425f.lnk")) returned 0x20 [0214.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ab48R1oYXYyDTLB_.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2602c10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2602c10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2602c10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ab48R1oYXYyDTLB_.lnk", cAlternateFileName="AB48R1~1.LNK")) returned 0x325018 [0214.851] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2602c10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2602c10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2602c10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ab48R1oYXYyDTLB_.lnk", cAlternateFileName="AB48R1~1.LNK")) returned 0 [0214.851] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0214.851] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ab48R1oYXYyDTLB_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ab48r1oyxyydtlb_.lnk")) returned 1 [0214.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ab48R1oYXYyDTLB_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ab48r1oyxyydtlb_.lnk")) returned 0xffffffff [0214.852] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15a54d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x19ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="AP8lSl0d6VwBCQ.lnk", cAlternateFileName="AP8LSL~1.LNK")) returned 1 [0214.852] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0214.852] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0214.853] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0214.853] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b07c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0214.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b07c) returned 0x10ab [0214.853] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0214.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AP8lSl0d6VwBCQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ap8lsl0d6vwbcq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0214.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4150386C536C3064365677424351.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4150386c536c3064365677424351.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0214.854] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19ad [0214.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0214.854] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0214.953] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19ad, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x19ad, lpOverlapped=0x0) returned 1 [0214.954] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x19b0, lpOverlapped=0x0) returned 1 [0214.955] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.977] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.987] CloseHandle (hObject=0x10c) returned 1 [0214.987] CloseHandle (hObject=0x104) returned 1 [0214.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AP8lSl0d6VwBCQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ap8lsl0d6vwbcq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4150386C536C3064365677424351.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4150386c536c3064365677424351.lnk")) returned 0 [0214.988] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4150386C536C3064365677424351.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4150386c536c3064365677424351.lnk")) returned 0x20 [0214.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AP8lSl0d6VwBCQ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15a54d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x19ad, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AP8lSl0d6VwBCQ.lnk", cAlternateFileName="AP8LSL~1.LNK")) returned 0x325018 [0214.988] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15a54d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x19ad, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AP8lSl0d6VwBCQ.lnk", cAlternateFileName="AP8LSL~1.LNK")) returned 0 [0214.988] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0214.989] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AP8lSl0d6VwBCQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ap8lsl0d6vwbcq.lnk")) returned 1 [0214.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AP8lSl0d6VwBCQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ap8lsl0d6vwbcq.lnk")) returned 0xffffffff [0214.990] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2aeb970, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2aeb970, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2aeb970, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1307, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATpq16lmy9w.flv.lnk", cAlternateFileName="ATPQ16~1.LNK")) returned 1 [0214.990] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0214.990] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.990] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0214.990] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0214.990] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0214.990] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0214.990] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0214.990] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0214.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ATpq16lmy9w.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\atpq16lmy9w.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0214.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4154707131366C6D7939772E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4154707131366c6d7939772e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0215.001] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1307 [0215.001] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0215.001] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0215.087] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1307, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1307, lpOverlapped=0x0) returned 1 [0215.087] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1310, lpOverlapped=0x0) returned 1 [0215.088] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.110] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.120] CloseHandle (hObject=0x104) returned 1 [0215.120] CloseHandle (hObject=0x10c) returned 1 [0215.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ATpq16lmy9w.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\atpq16lmy9w.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4154707131366C6D7939772E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4154707131366c6d7939772e666c76.lnk")) returned 0 [0215.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4154707131366C6D7939772E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4154707131366c6d7939772e666c76.lnk")) returned 0x20 [0215.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ATpq16lmy9w.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2aeb970, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2aeb970, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2aeb970, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1307, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ATpq16lmy9w.flv.lnk", cAlternateFileName="ATPQ16~1.LNK")) returned 0x325018 [0215.121] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2aeb970, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2aeb970, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2aeb970, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1307, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ATpq16lmy9w.flv.lnk", cAlternateFileName="ATPQ16~1.LNK")) returned 0 [0215.121] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0215.121] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ATpq16lmy9w.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\atpq16lmy9w.flv.lnk")) returned 1 [0215.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ATpq16lmy9w.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\atpq16lmy9w.flv.lnk")) returned 0xffffffff [0215.122] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0215.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x325018 [0215.122] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0215.123] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2699a20, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x150b6, dwReserved0=0xb600b4, dwReserved1=0x329f28, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0215.123] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.123] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0215.123] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.123] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.123] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0215.123] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0215.124] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa5f178d0, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0215.124] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.124] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.124] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.124] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0215.124] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.124] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.124] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0215.124] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0215.125] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0215.125] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.125] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0215.125] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0215.125] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0215.126] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0215.126] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0215.126] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1dadf10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e57910, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e57910, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xd95, dwReserved0=0x38626434, dwReserved1=0x75612e37, cFileName="B8WCF.lnk", cAlternateFileName="")) returned 1 [0215.126] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.126] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.126] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.126] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0215.126] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.126] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.126] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0215.126] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0215.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B8WCF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b8wcf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0215.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4238574346.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4238574346.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0215.130] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd95 [0215.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0215.130] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0215.215] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd95, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xd95, lpOverlapped=0x0) returned 1 [0215.216] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xda0, lpOverlapped=0x0) returned 1 [0215.217] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.239] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.250] CloseHandle (hObject=0x10c) returned 1 [0215.250] CloseHandle (hObject=0x104) returned 1 [0215.250] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B8WCF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b8wcf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4238574346.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4238574346.lnk")) returned 0 [0215.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4238574346.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4238574346.lnk")) returned 0x20 [0215.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B8WCF.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1dadf10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e57910, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e57910, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xd95, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="B8WCF.lnk", cAlternateFileName="")) returned 0x325018 [0215.251] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1dadf10, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e57910, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e57910, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xd95, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="B8WCF.lnk", cAlternateFileName="")) returned 0 [0215.251] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0215.251] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B8WCF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b8wcf.lnk")) returned 1 [0215.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B8WCF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b8wcf.lnk")) returned 0xffffffff [0215.252] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ba_Aj.lnk", cAlternateFileName="")) returned 1 [0215.253] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.253] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0215.253] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0215.253] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0215.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ba_Aj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ba_aj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0215.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\62615F416A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\62615f416a.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0215.254] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa00 [0215.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0215.255] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0215.349] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0215.351] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa10, lpOverlapped=0x0) returned 1 [0215.352] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.376] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.413] CloseHandle (hObject=0x104) returned 1 [0215.413] CloseHandle (hObject=0x10c) returned 1 [0215.413] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ba_Aj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ba_aj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\62615F416A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\62615f416a.lnk")) returned 0 [0215.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\62615F416A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\62615f416a.lnk")) returned 0x20 [0215.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ba_Aj.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ba_Aj.lnk", cAlternateFileName="")) returned 0x325018 [0215.415] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ba_Aj.lnk", cAlternateFileName="")) returned 0 [0215.415] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0215.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ba_Aj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ba_aj.lnk")) returned 1 [0215.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ba_Aj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ba_aj.lnk")) returned 0xffffffff [0215.416] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ef0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2baa050, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bct_Jx38ipMudu.lnk", cAlternateFileName="BCT_JX~1.LNK")) returned 1 [0215.417] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.417] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.417] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.417] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0215.418] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b06c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.418] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.418] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b06c) returned 0x10ab [0215.418] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0215.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bct_Jx38ipMudu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bct_jx38ipmudu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0215.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4263745F4A78333869704D756475.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4263745f4a78333869704d756475.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0215.420] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa47 [0215.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0215.420] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0215.615] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa47, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa47, lpOverlapped=0x0) returned 1 [0215.616] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa50, lpOverlapped=0x0) returned 1 [0215.617] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.649] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.660] CloseHandle (hObject=0x10c) returned 1 [0215.660] CloseHandle (hObject=0x104) returned 1 [0215.660] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bct_Jx38ipMudu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bct_jx38ipmudu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4263745F4A78333869704D756475.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4263745f4a78333869704d756475.lnk")) returned 0 [0215.661] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4263745F4A78333869704D756475.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4263745f4a78333869704d756475.lnk")) returned 0x20 [0215.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bct_Jx38ipMudu.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ef0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2baa050, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Bct_Jx38ipMudu.lnk", cAlternateFileName="BCT_JX~1.LNK")) returned 0x325018 [0215.661] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ef0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2baa050, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Bct_Jx38ipMudu.lnk", cAlternateFileName="BCT_JX~1.LNK")) returned 0 [0215.661] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0215.661] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bct_Jx38ipMudu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bct_jx38ipmudu.lnk")) returned 1 [0215.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bct_Jx38ipMudu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bct_jx38ipmudu.lnk")) returned 0xffffffff [0215.662] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a79550, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a79550, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a79550, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="c7yefA5lIdO1x.lnk", cAlternateFileName="C7YEFA~1.LNK")) returned 1 [0215.663] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.663] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.663] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.663] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.663] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.663] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af48) returned 0x10ab [0215.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c7yefA5lIdO1x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c7yefa5lido1x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0215.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\633779656641356C49644F3178.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\633779656641356c49644f3178.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0215.665] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa38 [0215.665] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0215.665] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0215.753] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa38, lpOverlapped=0x0) returned 1 [0215.754] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa40, lpOverlapped=0x0) returned 1 [0215.755] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.777] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.788] CloseHandle (hObject=0x104) returned 1 [0215.788] CloseHandle (hObject=0x10c) returned 1 [0215.788] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c7yefA5lIdO1x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c7yefa5lido1x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\633779656641356C49644F3178.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\633779656641356c49644f3178.lnk")) returned 0 [0215.789] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\633779656641356C49644F3178.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\633779656641356c49644f3178.lnk")) returned 0x20 [0215.789] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c7yefA5lIdO1x.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a79550, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a79550, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a79550, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="c7yefA5lIdO1x.lnk", cAlternateFileName="C7YEFA~1.LNK")) returned 0x325018 [0215.789] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a79550, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a79550, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a79550, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="c7yefA5lIdO1x.lnk", cAlternateFileName="C7YEFA~1.LNK")) returned 0 [0215.789] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0215.789] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c7yefA5lIdO1x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c7yefa5lido1x.lnk")) returned 1 [0215.790] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c7yefA5lIdO1x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c7yefa5lido1x.lnk")) returned 0xffffffff [0215.790] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2675030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2675030, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2675030, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CEtI_2JiZ 3mdnbliKF5.lnk", cAlternateFileName="CETI_2~1.LNK")) returned 1 [0215.790] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.790] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.791] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.791] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0215.791] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b08c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.791] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.791] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b08c) returned 0x10ab [0215.791] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0215.791] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CEtI_2JiZ 3mdnbliKF5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ceti_2jiz 3mdnblikf5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0215.791] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\434574495F324A695A20336D646E626C694B4635.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\434574495f324a695a20336d646e626c694b4635.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0215.792] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9e [0215.792] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0215.793] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0215.885] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa9e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa9e, lpOverlapped=0x0) returned 1 [0215.886] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xaa0, lpOverlapped=0x0) returned 1 [0215.887] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.909] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.921] CloseHandle (hObject=0x10c) returned 1 [0215.921] CloseHandle (hObject=0x104) returned 1 [0215.922] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CEtI_2JiZ 3mdnbliKF5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ceti_2jiz 3mdnblikf5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\434574495F324A695A20336D646E626C694B4635.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\434574495f324a695a20336d646e626c694b4635.lnk")) returned 0 [0215.923] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\434574495F324A695A20336D646E626C694B4635.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\434574495f324a695a20336d646e626c694b4635.lnk")) returned 0x20 [0215.923] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CEtI_2JiZ 3mdnbliKF5.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2675030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2675030, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2675030, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="CEtI_2JiZ 3mdnbliKF5.lnk", cAlternateFileName="CETI_2~1.LNK")) returned 0x325018 [0215.923] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2675030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2675030, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2675030, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="CEtI_2JiZ 3mdnbliKF5.lnk", cAlternateFileName="CETI_2~1.LNK")) returned 0 [0215.923] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0215.923] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CEtI_2JiZ 3mdnbliKF5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ceti_2jiz 3mdnblikf5.lnk")) returned 1 [0215.924] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CEtI_2JiZ 3mdnbliKF5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ceti_2jiz 3mdnblikf5.lnk")) returned 0xffffffff [0215.924] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1239530, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1239530, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1239530, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="cKZlsqaYbRP4R.lnk", cAlternateFileName="CKZLSQ~1.LNK")) returned 1 [0215.925] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0215.925] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.925] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0215.925] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0215.925] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0215.925] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0215.925] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0215.925] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0215.925] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cKZlsqaYbRP4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ckzlsqaybrp4r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0215.925] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\634B5A6C737161596252503452.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\634b5a6c737161596252503452.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0215.927] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0215.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0215.927] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0215.999] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x401, lpOverlapped=0x0) returned 1 [0215.999] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x410, lpOverlapped=0x0) returned 1 [0216.000] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.023] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.033] CloseHandle (hObject=0x104) returned 1 [0216.033] CloseHandle (hObject=0x10c) returned 1 [0216.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cKZlsqaYbRP4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ckzlsqaybrp4r.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\634B5A6C737161596252503452.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\634b5a6c737161596252503452.lnk")) returned 0 [0216.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\634B5A6C737161596252503452.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\634b5a6c737161596252503452.lnk")) returned 0x20 [0216.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cKZlsqaYbRP4R.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1239530, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1239530, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1239530, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cKZlsqaYbRP4R.lnk", cAlternateFileName="CKZLSQ~1.LNK")) returned 0x325018 [0216.035] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1239530, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1239530, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1239530, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cKZlsqaYbRP4R.lnk", cAlternateFileName="CKZLSQ~1.LNK")) returned 0 [0216.035] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.035] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cKZlsqaYbRP4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ckzlsqaybrp4r.lnk")) returned 1 [0216.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cKZlsqaYbRP4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ckzlsqaybrp4r.lnk")) returned 0xffffffff [0216.036] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2eefe90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2eefe90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2eefe90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cli2gG-yZRz6yUz.lnk", cAlternateFileName="CLI2GG~1.LNK")) returned 1 [0216.036] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.036] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.036] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.037] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.037] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.037] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.037] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.037] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.037] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cli2gG-yZRz6yUz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cli2gg-yzrz6yuz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0216.037] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\436C693267472D795A527A3679557A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\436c693267472d795a527a3679557a.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0216.038] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa4e [0216.038] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0216.039] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0216.128] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa4e, lpOverlapped=0x0) returned 1 [0216.129] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa50, lpOverlapped=0x0) returned 1 [0216.130] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.152] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.163] CloseHandle (hObject=0x10c) returned 1 [0216.163] CloseHandle (hObject=0x104) returned 1 [0216.163] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cli2gG-yZRz6yUz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cli2gg-yzrz6yuz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\436C693267472D795A527A3679557A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\436c693267472d795a527a3679557a.lnk")) returned 0 [0216.164] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\436C693267472D795A527A3679557A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\436c693267472d795a527a3679557a.lnk")) returned 0x20 [0216.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cli2gG-yZRz6yUz.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2eefe90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2eefe90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2eefe90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Cli2gG-yZRz6yUz.lnk", cAlternateFileName="CLI2GG~1.LNK")) returned 0x325018 [0216.164] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2eefe90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2eefe90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2eefe90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Cli2gG-yZRz6yUz.lnk", cAlternateFileName="CLI2GG~1.LNK")) returned 0 [0216.164] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.164] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cli2gG-yZRz6yUz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cli2gg-yzrz6yuz.lnk")) returned 1 [0216.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cli2gG-yZRz6yUz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cli2gg-yzrz6yuz.lnk")) returned 0xffffffff [0216.165] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2035670, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsmtSJAH1fH8LXWhLXAQ.lnk", cAlternateFileName="CSMTSJ~1.LNK")) returned 1 [0216.166] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.166] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.166] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.166] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.167] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.167] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b090) returned 0x10ab [0216.167] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CsmtSJAH1fH8LXWhLXAQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csmtsjah1fh8lxwhlxaq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0216.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\43736D74534A4148316648384C5857684C584151.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\43736d74534a4148316648384c5857684c584151.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0216.168] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0216.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0216.168] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0216.271] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x29b, lpOverlapped=0x0) returned 1 [0216.272] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2a0, lpOverlapped=0x0) returned 1 [0216.276] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.298] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.311] CloseHandle (hObject=0x104) returned 1 [0216.311] CloseHandle (hObject=0x10c) returned 1 [0216.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CsmtSJAH1fH8LXWhLXAQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csmtsjah1fh8lxwhlxaq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\43736D74534A4148316648384C5857684C584151.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\43736d74534a4148316648384c5857684c584151.lnk")) returned 0 [0216.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\43736D74534A4148316648384C5857684C584151.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\43736d74534a4148316648384c5857684c584151.lnk")) returned 0x20 [0216.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CsmtSJAH1fH8LXWhLXAQ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2035670, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CsmtSJAH1fH8LXWhLXAQ.lnk", cAlternateFileName="CSMTSJ~1.LNK")) returned 0x325018 [0216.315] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2035670, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CsmtSJAH1fH8LXWhLXAQ.lnk", cAlternateFileName="CSMTSJ~1.LNK")) returned 0 [0216.315] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.315] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CsmtSJAH1fH8LXWhLXAQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csmtsjah1fh8lxwhlxaq.lnk")) returned 1 [0216.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CsmtSJAH1fH8LXWhLXAQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csmtsjah1fh8lxwhlxaq.lnk")) returned 0xffffffff [0216.316] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="cTHvtkFjn9.lnk", cAlternateFileName="CTHVTK~1.LNK")) returned 1 [0216.319] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.320] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.322] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.322] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.322] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.322] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.322] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.322] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cTHvtkFjn9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cthvtkfjn9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0216.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63544876746B466A6E39.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63544876746b466a6e39.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0216.334] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa37 [0216.335] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0216.335] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0216.431] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa37, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa37, lpOverlapped=0x0) returned 1 [0216.432] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa40, lpOverlapped=0x0) returned 1 [0216.433] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.454] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.465] CloseHandle (hObject=0x10c) returned 1 [0216.465] CloseHandle (hObject=0x104) returned 1 [0216.465] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cTHvtkFjn9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cthvtkfjn9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63544876746B466A6E39.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63544876746b466a6e39.lnk")) returned 0 [0216.466] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63544876746B466A6E39.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63544876746b466a6e39.lnk")) returned 0x20 [0216.466] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cTHvtkFjn9.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="cTHvtkFjn9.lnk", cAlternateFileName="CTHVTK~1.LNK")) returned 0x325018 [0216.467] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="cTHvtkFjn9.lnk", cAlternateFileName="CTHVTK~1.LNK")) returned 0 [0216.467] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.467] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cTHvtkFjn9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cthvtkfjn9.lnk")) returned 1 [0216.468] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cTHvtkFjn9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cthvtkfjn9.lnk")) returned 0xffffffff [0216.468] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0216.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x335f48, cFileName=".", cAlternateFileName="")) returned 0x325018 [0216.469] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x335f48, cFileName="..", cAlternateFileName="")) returned 1 [0216.469] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xac00aa, dwReserved1=0x335f48, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0216.469] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.469] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.469] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.469] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.470] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.470] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.470] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.470] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.470] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0216.470] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.470] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.470] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.470] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.471] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.471] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.471] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.471] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.471] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0216.471] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.471] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.471] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.471] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.472] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.472] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.472] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.472] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.472] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0216.472] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.472] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.472] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.472] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.473] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.473] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.473] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.473] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.473] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0216.474] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.474] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.474] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.474] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.474] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.474] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.474] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.474] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.474] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0216.475] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.475] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.475] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.475] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.475] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.475] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.475] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.475] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.475] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0216.476] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.476] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.476] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.476] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.476] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.476] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.476] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.476] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.476] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0216.476] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.477] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2628d70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2628d70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2628d70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x32396337, dwReserved1=0x75632e39, cFileName="CzmGKArM5A.lnk", cAlternateFileName="CZMGKA~1.LNK")) returned 1 [0216.477] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.477] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.477] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.477] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.478] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.478] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.478] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0216.478] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CzmGKArM5A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czmgkarm5a.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0216.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\437A6D474B41724D3541.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\437a6d474b41724d3541.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0216.479] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1b [0216.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0216.479] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0216.566] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa1b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa1b, lpOverlapped=0x0) returned 1 [0216.566] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0216.567] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.590] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.603] CloseHandle (hObject=0x104) returned 1 [0216.603] CloseHandle (hObject=0x10c) returned 1 [0216.603] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CzmGKArM5A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czmgkarm5a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\437A6D474B41724D3541.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\437a6d474b41724d3541.lnk")) returned 0 [0216.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\437A6D474B41724D3541.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\437a6d474b41724d3541.lnk")) returned 0x20 [0216.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CzmGKArM5A.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2628d70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2628d70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2628d70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CzmGKArM5A.lnk", cAlternateFileName="CZMGKA~1.LNK")) returned 0x325018 [0216.604] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2628d70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2628d70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2628d70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CzmGKArM5A.lnk", cAlternateFileName="CZMGKA~1.LNK")) returned 0 [0216.604] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.604] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CzmGKArM5A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czmgkarm5a.lnk")) returned 1 [0216.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CzmGKArM5A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czmgkarm5a.lnk")) returned 0xffffffff [0216.605] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x181c, dwReserved0=0x0, dwReserved1=0x0, cFileName="d0cPEl.lnk", cAlternateFileName="")) returned 1 [0216.606] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.606] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.606] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.606] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.606] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.606] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.606] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0216.606] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d0cPEl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0cpel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0216.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\64306350456C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\64306350456c.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0216.607] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x181c [0216.607] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0216.608] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0216.679] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x181c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x181c, lpOverlapped=0x0) returned 1 [0216.680] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1820, lpOverlapped=0x0) returned 1 [0216.681] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.703] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.714] CloseHandle (hObject=0x10c) returned 1 [0216.714] CloseHandle (hObject=0x104) returned 1 [0216.714] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d0cPEl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0cpel.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\64306350456C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\64306350456c.lnk")) returned 0 [0216.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\64306350456C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\64306350456c.lnk")) returned 0x20 [0216.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d0cPEl.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x181c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="d0cPEl.lnk", cAlternateFileName="")) returned 0x325018 [0216.715] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x181c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="d0cPEl.lnk", cAlternateFileName="")) returned 0 [0216.715] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.715] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d0cPEl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0cpel.lnk")) returned 1 [0216.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d0cPEl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0cpel.lnk")) returned 0xffffffff [0216.716] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0216.717] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.717] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.717] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.717] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.717] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.717] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.717] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b090) returned 0x10ab [0216.718] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0216.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0216.719] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b0 [0216.719] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0216.719] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0216.816] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0216.816] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1c0, lpOverlapped=0x0) returned 1 [0216.817] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.840] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.851] CloseHandle (hObject=0x104) returned 1 [0216.851] CloseHandle (hObject=0x10c) returned 1 [0216.851] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6465736b746f70.ini")) returned 0 [0216.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6465736b746f70.ini")) returned 0x20 [0216.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0216.852] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0216.852] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.852] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 1 [0216.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 0xffffffff [0216.853] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d4cf70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGInpAUkDN4Vg05-.mkv.lnk", cAlternateFileName="DGINPA~1.LNK")) returned 1 [0216.854] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.854] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.854] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.854] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.854] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.854] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.854] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0216.854] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DGInpAUkDN4Vg05-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dginpaukdn4vg05-.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0216.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4447496E7041556B444E34566730352D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4447496e7041556b444e34566730352d2e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0216.856] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18c2 [0216.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0216.856] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0216.946] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18c2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18c2, lpOverlapped=0x0) returned 1 [0216.947] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x18d0, lpOverlapped=0x0) returned 1 [0216.948] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.970] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.981] CloseHandle (hObject=0x10c) returned 1 [0216.981] CloseHandle (hObject=0x104) returned 1 [0216.982] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DGInpAUkDN4Vg05-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dginpaukdn4vg05-.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4447496E7041556B444E34566730352D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4447496e7041556b444e34566730352d2e6d6b76.lnk")) returned 0 [0216.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4447496E7041556B444E34566730352D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4447496e7041556b444e34566730352d2e6d6b76.lnk")) returned 0x20 [0216.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DGInpAUkDN4Vg05-.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d4cf70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="DGInpAUkDN4Vg05-.mkv.lnk", cAlternateFileName="DGINPA~1.LNK")) returned 0x325018 [0216.983] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d4cf70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="DGInpAUkDN4Vg05-.mkv.lnk", cAlternateFileName="DGINPA~1.LNK")) returned 0 [0216.983] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0216.983] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DGInpAUkDN4Vg05-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dginpaukdn4vg05-.mkv.lnk")) returned 1 [0216.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DGInpAUkDN4Vg05-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dginpaukdn4vg05-.mkv.lnk")) returned 0xffffffff [0216.984] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2485e50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2485e50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2485e50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="DXr5NvZcAsQloxQc.flv.lnk", cAlternateFileName="DXR5NV~1.LNK")) returned 1 [0216.984] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0216.984] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.984] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0216.984] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0216.985] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0216.985] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0216.985] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0216.985] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0216.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXr5NvZcAsQloxQc.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxr5nvzcasqloxqc.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0216.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\445872354E765A634173516C6F7851632E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\445872354e765a634173516c6f7851632e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0216.986] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18c2 [0216.986] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0216.987] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0217.074] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18c2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18c2, lpOverlapped=0x0) returned 1 [0217.075] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x18d0, lpOverlapped=0x0) returned 1 [0217.076] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.099] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.109] CloseHandle (hObject=0x104) returned 1 [0217.109] CloseHandle (hObject=0x10c) returned 1 [0217.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXr5NvZcAsQloxQc.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxr5nvzcasqloxqc.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\445872354E765A634173516C6F7851632E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\445872354e765a634173516c6f7851632e666c76.lnk")) returned 0 [0217.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\445872354E765A634173516C6F7851632E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\445872354e765a634173516c6f7851632e666c76.lnk")) returned 0x20 [0217.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXr5NvZcAsQloxQc.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2485e50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2485e50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2485e50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="DXr5NvZcAsQloxQc.flv.lnk", cAlternateFileName="DXR5NV~1.LNK")) returned 0x325018 [0217.111] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2485e50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2485e50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2485e50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="DXr5NvZcAsQloxQc.flv.lnk", cAlternateFileName="DXR5NV~1.LNK")) returned 0 [0217.111] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0217.111] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXr5NvZcAsQloxQc.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxr5nvzcasqloxqc.flv.lnk")) returned 1 [0217.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXr5NvZcAsQloxQc.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxr5nvzcasqloxqc.flv.lnk")) returned 0xffffffff [0217.112] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="E5JOoW2CWdnVJ.lnk", cAlternateFileName="E5JOOW~1.LNK")) returned 1 [0217.112] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0217.112] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0217.112] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0217.113] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0217.113] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.113] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0217.113] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0217.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E5JOoW2CWdnVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e5joow2cwdnvj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0217.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\45354A4F6F57324357646E564A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\45354a4f6f57324357646e564a.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0217.114] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x389 [0217.115] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0217.115] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0217.191] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x389, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x389, lpOverlapped=0x0) returned 1 [0217.192] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x390, lpOverlapped=0x0) returned 1 [0217.193] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.215] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.226] CloseHandle (hObject=0x10c) returned 1 [0217.226] CloseHandle (hObject=0x104) returned 1 [0217.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E5JOoW2CWdnVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e5joow2cwdnvj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\45354A4F6F57324357646E564A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\45354a4f6f57324357646e564a.lnk")) returned 0 [0217.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\45354A4F6F57324357646E564A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\45354a4f6f57324357646e564a.lnk")) returned 0x20 [0217.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E5JOoW2CWdnVJ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="E5JOoW2CWdnVJ.lnk", cAlternateFileName="E5JOOW~1.LNK")) returned 0x325018 [0217.227] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="E5JOoW2CWdnVJ.lnk", cAlternateFileName="E5JOOW~1.LNK")) returned 0 [0217.227] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0217.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E5JOoW2CWdnVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e5joow2cwdnvj.lnk")) returned 1 [0217.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E5JOoW2CWdnVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e5joow2cwdnvj.lnk")) returned 0xffffffff [0217.228] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x0, dwReserved1=0x0, cFileName="eE1dl Ox8VHRTQ.lnk", cAlternateFileName="EE1DLO~1.LNK")) returned 1 [0217.229] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0217.229] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0217.229] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0217.229] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0217.229] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0217.229] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0217.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eE1dl Ox8VHRTQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ee1dl ox8vhrtq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0217.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\654531646C204F78385648525451.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\654531646c204f78385648525451.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0217.231] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x406 [0217.231] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0217.231] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0217.322] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x406, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x406, lpOverlapped=0x0) returned 1 [0217.323] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x410, lpOverlapped=0x0) returned 1 [0217.324] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.347] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.366] CloseHandle (hObject=0x104) returned 1 [0217.366] CloseHandle (hObject=0x10c) returned 1 [0217.366] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eE1dl Ox8VHRTQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ee1dl ox8vhrtq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\654531646C204F78385648525451.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\654531646c204f78385648525451.lnk")) returned 0 [0217.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\654531646C204F78385648525451.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\654531646c204f78385648525451.lnk")) returned 0x20 [0217.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eE1dl Ox8VHRTQ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="eE1dl Ox8VHRTQ.lnk", cAlternateFileName="EE1DLO~1.LNK")) returned 0x325018 [0217.367] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="eE1dl Ox8VHRTQ.lnk", cAlternateFileName="EE1DLO~1.LNK")) returned 0 [0217.367] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0217.367] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eE1dl Ox8VHRTQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ee1dl ox8vhrtq.lnk")) returned 1 [0217.368] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eE1dl Ox8VHRTQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ee1dl ox8vhrtq.lnk")) returned 0xffffffff [0217.368] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa277f9d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa277f9d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa277f9d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1eea, dwReserved0=0x0, dwReserved1=0x0, cFileName="EedcEQ j_Jalmx7-H.mkv.lnk", cAlternateFileName="EEDCEQ~1.LNK")) returned 1 [0217.369] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0217.369] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.369] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0217.369] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0217.370] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0217.370] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.370] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0217.370] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0217.370] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EedcEQ j_Jalmx7-H.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eedceq j_jalmx7-h.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0217.370] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\456564634551206A5F4A616C6D78372D482E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\456564634551206a5f4a616c6d78372d482e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0217.371] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1eea [0217.371] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0217.371] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0217.465] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1eea, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1eea, lpOverlapped=0x0) returned 1 [0217.465] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1ef0, lpOverlapped=0x0) returned 1 [0217.466] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.488] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.499] CloseHandle (hObject=0x10c) returned 1 [0217.499] CloseHandle (hObject=0x104) returned 1 [0217.499] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EedcEQ j_Jalmx7-H.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eedceq j_jalmx7-h.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\456564634551206A5F4A616C6D78372D482E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\456564634551206a5f4a616c6d78372d482e6d6b76.lnk")) returned 0 [0217.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\456564634551206A5F4A616C6D78372D482E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\456564634551206a5f4a616c6d78372d482e6d6b76.lnk")) returned 0x20 [0217.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EedcEQ j_Jalmx7-H.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa277f9d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa277f9d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa277f9d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1eea, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="EedcEQ j_Jalmx7-H.mkv.lnk", cAlternateFileName="EEDCEQ~1.LNK")) returned 0x325018 [0217.500] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa277f9d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa277f9d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa277f9d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1eea, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="EedcEQ j_Jalmx7-H.mkv.lnk", cAlternateFileName="EEDCEQ~1.LNK")) returned 0 [0217.500] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0217.500] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EedcEQ j_Jalmx7-H.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eedceq j_jalmx7-h.mkv.lnk")) returned 1 [0217.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EedcEQ j_Jalmx7-H.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eedceq j_jalmx7-h.mkv.lnk")) returned 0xffffffff [0217.501] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2eefe90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2eefe90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2eefe90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="eiY9yHOaf.lnk", cAlternateFileName="EIY9YH~1.LNK")) returned 1 [0217.502] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0217.502] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.502] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0217.502] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0217.502] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0217.502] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.502] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0217.502] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0217.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eiY9yHOaf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eiy9yhoaf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0217.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6569593979484F6166.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6569593979484f6166.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0217.504] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23e [0217.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0217.504] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0217.607] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x23e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x23e, lpOverlapped=0x0) returned 1 [0217.608] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x240, lpOverlapped=0x0) returned 1 [0217.610] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.632] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.643] CloseHandle (hObject=0x104) returned 1 [0217.643] CloseHandle (hObject=0x10c) returned 1 [0217.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eiY9yHOaf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eiy9yhoaf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6569593979484F6166.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6569593979484f6166.lnk")) returned 0 [0217.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6569593979484F6166.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6569593979484f6166.lnk")) returned 0x20 [0217.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eiY9yHOaf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2eefe90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2eefe90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2eefe90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="eiY9yHOaf.lnk", cAlternateFileName="EIY9YH~1.LNK")) returned 0x325018 [0217.645] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2eefe90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2eefe90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2eefe90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="eiY9yHOaf.lnk", cAlternateFileName="EIY9YH~1.LNK")) returned 0 [0217.645] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0217.645] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eiY9yHOaf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eiy9yhoaf.lnk")) returned 1 [0217.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eiY9yHOaf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eiy9yhoaf.lnk")) returned 0xffffffff [0217.646] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b11ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b11ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b11ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="El8GD-oph.lnk", cAlternateFileName="EL8GD-~1.LNK")) returned 1 [0217.647] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0217.647] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.648] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0217.648] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0217.648] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0217.648] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.648] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0ac) returned 0x10ab [0217.648] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0217.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\El8GD-oph.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\el8gd-oph.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0217.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\456C3847442D6F7068.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\456c3847442d6f7068.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0217.650] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ed [0217.650] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0217.650] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0217.737] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3ed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3ed, lpOverlapped=0x0) returned 1 [0217.738] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0217.739] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.761] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.771] CloseHandle (hObject=0x10c) returned 1 [0217.771] CloseHandle (hObject=0x104) returned 1 [0217.772] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\El8GD-oph.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\el8gd-oph.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\456C3847442D6F7068.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\456c3847442d6f7068.lnk")) returned 0 [0217.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\456C3847442D6F7068.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\456c3847442d6f7068.lnk")) returned 0x20 [0217.773] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\El8GD-oph.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b11ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b11ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b11ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="El8GD-oph.lnk", cAlternateFileName="EL8GD-~1.LNK")) returned 0x325018 [0217.773] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b11ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b11ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b11ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="El8GD-oph.lnk", cAlternateFileName="EL8GD-~1.LNK")) returned 0 [0217.773] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0217.773] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\El8GD-oph.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\el8gd-oph.lnk")) returned 1 [0217.774] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\El8GD-oph.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\el8gd-oph.lnk")) returned 0xffffffff [0217.774] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa136a030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29e0fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29e0fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x991, dwReserved0=0x0, dwReserved1=0x0, cFileName="epGfDJqj.lnk", cAlternateFileName="")) returned 1 [0217.774] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0217.774] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.774] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0217.774] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0217.775] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0217.775] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.775] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0217.775] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0217.775] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\epGfDJqj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\epgfdjqj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0217.775] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\65704766444A716A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\65704766444a716a.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0217.776] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x991 [0217.776] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0217.777] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0217.850] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x991, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x991, lpOverlapped=0x0) returned 1 [0217.851] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x9a0, lpOverlapped=0x0) returned 1 [0217.852] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.874] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.885] CloseHandle (hObject=0x104) returned 1 [0217.885] CloseHandle (hObject=0x10c) returned 1 [0217.885] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\epGfDJqj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\epgfdjqj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\65704766444A716A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\65704766444a716a.lnk")) returned 0 [0217.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\65704766444A716A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\65704766444a716a.lnk")) returned 0x20 [0217.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\epGfDJqj.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa136a030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29e0fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29e0fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x991, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="epGfDJqj.lnk", cAlternateFileName="")) returned 0x325018 [0217.886] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa136a030, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29e0fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29e0fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x991, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="epGfDJqj.lnk", cAlternateFileName="")) returned 0 [0217.886] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0217.886] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\epGfDJqj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\epgfdjqj.lnk")) returned 1 [0217.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\epGfDJqj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\epgfdjqj.lnk")) returned 0xffffffff [0217.887] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1806ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1806ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1806ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="esRbL6YGg9mHVD.lnk", cAlternateFileName="ESRBL6~1.LNK")) returned 1 [0217.888] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0217.888] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.888] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0217.888] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0217.888] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0217.888] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0217.888] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0217.888] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0217.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\esRbL6YGg9mHVD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\esrbl6ygg9mhvd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0217.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\657352624C36594767396D485644.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\657352624c36594767396d485644.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0217.890] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e8 [0217.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0217.890] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0217.978] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2e8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2e8, lpOverlapped=0x0) returned 1 [0217.979] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2f0, lpOverlapped=0x0) returned 1 [0217.980] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.002] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.013] CloseHandle (hObject=0x10c) returned 1 [0218.013] CloseHandle (hObject=0x104) returned 1 [0218.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\esRbL6YGg9mHVD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\esrbl6ygg9mhvd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\657352624C36594767396D485644.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\657352624c36594767396d485644.lnk")) returned 0 [0218.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\657352624C36594767396D485644.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\657352624c36594767396d485644.lnk")) returned 0x20 [0218.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\esRbL6YGg9mHVD.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1806ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1806ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1806ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="esRbL6YGg9mHVD.lnk", cAlternateFileName="ESRBL6~1.LNK")) returned 0x325018 [0218.014] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1806ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1806ad0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1806ad0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="esRbL6YGg9mHVD.lnk", cAlternateFileName="ESRBL6~1.LNK")) returned 0 [0218.014] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0218.014] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\esRbL6YGg9mHVD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\esrbl6ygg9mhvd.lnk")) returned 1 [0218.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\esRbL6YGg9mHVD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\esrbl6ygg9mhvd.lnk")) returned 0xffffffff [0218.015] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa245fcf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXAA7.lnk", cAlternateFileName="")) returned 1 [0218.015] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0218.015] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.015] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0218.015] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0218.016] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0218.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.016] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0218.016] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0218.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EXAA7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\exaa7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0218.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4558414137.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4558414137.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0218.017] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x93b [0218.017] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0218.017] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0218.112] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x93b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x93b, lpOverlapped=0x0) returned 1 [0218.113] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x940, lpOverlapped=0x0) returned 1 [0218.114] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.137] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.149] CloseHandle (hObject=0x104) returned 1 [0218.149] CloseHandle (hObject=0x10c) returned 1 [0218.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EXAA7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\exaa7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4558414137.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4558414137.lnk")) returned 0 [0218.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4558414137.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4558414137.lnk")) returned 0x20 [0218.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EXAA7.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa245fcf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="EXAA7.lnk", cAlternateFileName="")) returned 0x325018 [0218.150] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa245fcf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="EXAA7.lnk", cAlternateFileName="")) returned 0 [0218.150] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0218.150] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EXAA7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\exaa7.lnk")) returned 1 [0218.151] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EXAA7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\exaa7.lnk")) returned 0xffffffff [0218.151] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c425d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeac, dwReserved0=0x0, dwReserved1=0x0, cFileName="fDIESgABicwyn1818tYB.flv.lnk", cAlternateFileName="FDIESG~1.LNK")) returned 1 [0218.152] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0218.152] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0218.152] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0218.152] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0218.152] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0218.152] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0218.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fDIESgABicwyn1818tYB.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdiesgabicwyn1818tyb.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0218.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6644494553674142696377796E313831387459422E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6644494553674142696377796e313831387459422e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0218.154] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeac [0218.154] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0218.154] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0218.259] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xeac, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xeac, lpOverlapped=0x0) returned 1 [0218.260] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xeb0, lpOverlapped=0x0) returned 1 [0218.262] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.286] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.297] CloseHandle (hObject=0x10c) returned 1 [0218.297] CloseHandle (hObject=0x104) returned 1 [0218.298] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fDIESgABicwyn1818tYB.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdiesgabicwyn1818tyb.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6644494553674142696377796E313831387459422E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6644494553674142696377796e313831387459422e666c76.lnk")) returned 0 [0218.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6644494553674142696377796E313831387459422E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6644494553674142696377796e313831387459422e666c76.lnk")) returned 0x20 [0218.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fDIESgABicwyn1818tYB.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c425d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeac, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fDIESgABicwyn1818tYB.flv.lnk", cAlternateFileName="FDIESG~1.LNK")) returned 0x325018 [0218.300] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c425d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeac, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fDIESgABicwyn1818tYB.flv.lnk", cAlternateFileName="FDIESG~1.LNK")) returned 0 [0218.300] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0218.300] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fDIESgABicwyn1818tYB.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdiesgabicwyn1818tyb.flv.lnk")) returned 1 [0218.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fDIESgABicwyn1818tYB.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdiesgabicwyn1818tyb.flv.lnk")) returned 0xffffffff [0218.301] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa232f1f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d26e10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d26e10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="fLYMxN0uZ4.lnk", cAlternateFileName="FLYMXN~1.LNK")) returned 1 [0218.302] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0218.302] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.302] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0218.302] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0218.303] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0218.303] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.303] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0218.303] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0218.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fLYMxN0uZ4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\flymxn0uz4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0218.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\664C594D784E30755A34.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\664c594d784e30755a34.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0218.305] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0218.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0218.305] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0218.418] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x269, lpOverlapped=0x0) returned 1 [0218.418] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x270, lpOverlapped=0x0) returned 1 [0218.419] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.442] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.453] CloseHandle (hObject=0x104) returned 1 [0218.453] CloseHandle (hObject=0x10c) returned 1 [0218.453] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fLYMxN0uZ4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\flymxn0uz4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\664C594D784E30755A34.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\664c594d784e30755a34.lnk")) returned 0 [0218.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\664C594D784E30755A34.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\664c594d784e30755a34.lnk")) returned 0x20 [0218.454] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fLYMxN0uZ4.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa232f1f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d26e10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d26e10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="fLYMxN0uZ4.lnk", cAlternateFileName="FLYMXN~1.LNK")) returned 0x325018 [0218.454] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa232f1f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d26e10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d26e10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="fLYMxN0uZ4.lnk", cAlternateFileName="FLYMXN~1.LNK")) returned 0 [0218.454] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0218.454] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fLYMxN0uZ4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\flymxn0uz4.lnk")) returned 1 [0218.461] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fLYMxN0uZ4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\flymxn0uz4.lnk")) returned 0xffffffff [0218.461] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="gCAt8.lnk", cAlternateFileName="")) returned 1 [0218.462] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0218.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0218.462] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0218.462] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0218.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0218.462] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0218.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gCAt8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcat8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0218.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6743417438.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6743417438.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0218.464] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa00 [0218.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0218.464] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0218.539] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0218.539] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa10, lpOverlapped=0x0) returned 1 [0218.540] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.563] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.574] CloseHandle (hObject=0x10c) returned 1 [0218.574] CloseHandle (hObject=0x104) returned 1 [0218.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gCAt8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcat8.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6743417438.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6743417438.lnk")) returned 0 [0218.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6743417438.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6743417438.lnk")) returned 0x20 [0218.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gCAt8.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="gCAt8.lnk", cAlternateFileName="")) returned 0x325018 [0218.575] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa283e0b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa283e0b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa283e0b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="gCAt8.lnk", cAlternateFileName="")) returned 0 [0218.575] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0218.575] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gCAt8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcat8.lnk")) returned 1 [0218.576] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gCAt8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcat8.lnk")) returned 0xffffffff [0218.576] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27f1df0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa27f1df0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa27f1df0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x0, cFileName="gj9CrmcWLewwKpu.lnk", cAlternateFileName="GJ9CRM~1.LNK")) returned 1 [0218.577] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0218.577] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.577] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0218.577] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0218.577] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0218.577] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.577] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0218.577] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0218.578] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gj9CrmcWLewwKpu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gj9crmcwlewwkpu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0218.578] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\676A3943726D63574C6577774B7075.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\676a3943726d63574c6577774b7075.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0218.579] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25c [0218.579] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0218.579] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0218.670] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x25c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x25c, lpOverlapped=0x0) returned 1 [0218.671] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x260, lpOverlapped=0x0) returned 1 [0218.672] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.694] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.705] CloseHandle (hObject=0x104) returned 1 [0218.705] CloseHandle (hObject=0x10c) returned 1 [0218.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gj9CrmcWLewwKpu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gj9crmcwlewwkpu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\676A3943726D63574C6577774B7075.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\676a3943726d63574c6577774b7075.lnk")) returned 0 [0218.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\676A3943726D63574C6577774B7075.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\676a3943726d63574c6577774b7075.lnk")) returned 0x20 [0218.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gj9CrmcWLewwKpu.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27f1df0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa27f1df0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa27f1df0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="gj9CrmcWLewwKpu.lnk", cAlternateFileName="GJ9CRM~1.LNK")) returned 0x325018 [0218.707] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27f1df0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa27f1df0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa27f1df0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="gj9CrmcWLewwKpu.lnk", cAlternateFileName="GJ9CRM~1.LNK")) returned 0 [0218.707] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0218.707] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gj9CrmcWLewwKpu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gj9crmcwlewwkpu.lnk")) returned 1 [0218.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gj9CrmcWLewwKpu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gj9crmcwlewwkpu.lnk")) returned 0xffffffff [0218.708] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d99230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d99230, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d99230, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x0, dwReserved1=0x0, cFileName="gOzdYe.flv.lnk", cAlternateFileName="GOZDYE~1.LNK")) returned 1 [0218.708] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0218.708] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.708] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0218.708] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0218.709] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0218.709] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.709] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0218.709] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0218.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOzdYe.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gozdye.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0218.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\674F7A6459652E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\674f7a6459652e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0218.710] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe12 [0218.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0218.711] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0218.802] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe12, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe12, lpOverlapped=0x0) returned 1 [0218.803] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xe20, lpOverlapped=0x0) returned 1 [0218.804] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.827] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.837] CloseHandle (hObject=0x10c) returned 1 [0218.838] CloseHandle (hObject=0x104) returned 1 [0218.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOzdYe.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gozdye.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\674F7A6459652E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\674f7a6459652e666c76.lnk")) returned 0 [0218.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\674F7A6459652E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\674f7a6459652e666c76.lnk")) returned 0x20 [0218.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOzdYe.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d99230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d99230, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d99230, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="gOzdYe.flv.lnk", cAlternateFileName="GOZDYE~1.LNK")) returned 0x325018 [0218.839] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d99230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d99230, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d99230, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="gOzdYe.flv.lnk", cAlternateFileName="GOZDYE~1.LNK")) returned 0 [0218.839] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0218.839] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOzdYe.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gozdye.flv.lnk")) returned 1 [0218.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOzdYe.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gozdye.flv.lnk")) returned 0xffffffff [0218.840] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa264eed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa264eed0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa264eed0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="H7u.lnk", cAlternateFileName="")) returned 1 [0218.841] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0218.841] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.841] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0218.841] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0218.841] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0218.841] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.841] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0218.841] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0218.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H7u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h7u.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0218.842] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\483775.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\483775.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0218.843] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20c9 [0218.843] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0218.843] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0218.932] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x20c9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x20c9, lpOverlapped=0x0) returned 1 [0218.933] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x20d0, lpOverlapped=0x0) returned 1 [0218.934] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.956] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.967] CloseHandle (hObject=0x104) returned 1 [0218.967] CloseHandle (hObject=0x10c) returned 1 [0218.967] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H7u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h7u.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\483775.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\483775.lnk")) returned 0 [0218.968] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\483775.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\483775.lnk")) returned 0x20 [0218.968] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H7u.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa264eed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa264eed0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa264eed0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20c9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="H7u.lnk", cAlternateFileName="")) returned 0x325018 [0218.968] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa264eed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa264eed0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa264eed0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20c9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="H7u.lnk", cAlternateFileName="")) returned 0 [0218.968] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0218.968] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H7u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h7u.lnk")) returned 1 [0218.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H7u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h7u.lnk")) returned 0xffffffff [0218.969] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa205b7d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa205b7d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa205b7d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="HsooFVdcAyW_RW.lnk", cAlternateFileName="HSOOFV~1.LNK")) returned 1 [0218.970] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0218.970] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.970] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0218.970] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0218.970] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0218.970] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0218.970] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0218.971] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0218.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HsooFVdcAyW_RW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hsoofvdcayw_rw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0218.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\48736F6F465664634179575F5257.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\48736f6f465664634179575f5257.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0218.972] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa63 [0218.972] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0218.972] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0219.044] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa63, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa63, lpOverlapped=0x0) returned 1 [0219.045] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa70, lpOverlapped=0x0) returned 1 [0219.046] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.068] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.079] CloseHandle (hObject=0x10c) returned 1 [0219.080] CloseHandle (hObject=0x104) returned 1 [0219.080] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HsooFVdcAyW_RW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hsoofvdcayw_rw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\48736F6F465664634179575F5257.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\48736f6f465664634179575f5257.lnk")) returned 0 [0219.081] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\48736F6F465664634179575F5257.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\48736f6f465664634179575f5257.lnk")) returned 0x20 [0219.081] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HsooFVdcAyW_RW.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa205b7d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa205b7d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa205b7d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="HsooFVdcAyW_RW.lnk", cAlternateFileName="HSOOFV~1.LNK")) returned 0x325018 [0219.081] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa205b7d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa205b7d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa205b7d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="HsooFVdcAyW_RW.lnk", cAlternateFileName="HSOOFV~1.LNK")) returned 0 [0219.081] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0219.081] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HsooFVdcAyW_RW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hsoofvdcayw_rw.lnk")) returned 1 [0219.082] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HsooFVdcAyW_RW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hsoofvdcayw_rw.lnk")) returned 0xffffffff [0219.082] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c425d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hu0M4XwKGRbpnH.lnk", cAlternateFileName="HU0M4X~1.LNK")) returned 1 [0219.082] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0219.082] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.083] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0219.083] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0219.083] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0219.083] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.083] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0219.083] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0219.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hu0M4XwKGRbpnH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu0m4xwkgrbpnh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0219.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4875304D3458774B475262706E48.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4875304d3458774b475262706e48.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0219.084] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa63 [0219.084] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0219.085] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0219.181] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa63, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa63, lpOverlapped=0x0) returned 1 [0219.182] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa70, lpOverlapped=0x0) returned 1 [0219.186] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.209] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.222] CloseHandle (hObject=0x104) returned 1 [0219.222] CloseHandle (hObject=0x10c) returned 1 [0219.225] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hu0M4XwKGRbpnH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu0m4xwkgrbpnh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4875304D3458774B475262706E48.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4875304d3458774b475262706e48.lnk")) returned 0 [0219.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4875304D3458774B475262706E48.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4875304d3458774b475262706e48.lnk")) returned 0x20 [0219.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hu0M4XwKGRbpnH.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c425d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Hu0M4XwKGRbpnH.lnk", cAlternateFileName="HU0M4X~1.LNK")) returned 0x325018 [0219.226] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c425d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Hu0M4XwKGRbpnH.lnk", cAlternateFileName="HU0M4X~1.LNK")) returned 0 [0219.226] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0219.226] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hu0M4XwKGRbpnH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu0m4xwkgrbpnh.lnk")) returned 1 [0219.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hu0M4XwKGRbpnH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu0m4xwkgrbpnh.lnk")) returned 0xffffffff [0219.228] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a07130, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a07130, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a07130, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IAdB.lnk", cAlternateFileName="")) returned 1 [0219.231] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0219.231] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.233] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0219.233] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0219.234] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0219.234] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.234] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0219.234] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0219.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IAdB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iadb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0219.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\49416442.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\49416442.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0219.236] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d0 [0219.236] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0219.236] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0219.325] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3d0, lpOverlapped=0x0) returned 1 [0219.325] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3e0, lpOverlapped=0x0) returned 1 [0219.327] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.351] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.362] CloseHandle (hObject=0x10c) returned 1 [0219.362] CloseHandle (hObject=0x104) returned 1 [0219.362] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IAdB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iadb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\49416442.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\49416442.lnk")) returned 0 [0219.363] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\49416442.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\49416442.lnk")) returned 0x20 [0219.363] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IAdB.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a07130, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a07130, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a07130, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="IAdB.lnk", cAlternateFileName="")) returned 0x325018 [0219.363] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a07130, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a07130, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a07130, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="IAdB.lnk", cAlternateFileName="")) returned 0 [0219.363] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0219.363] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IAdB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iadb.lnk")) returned 1 [0219.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IAdB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iadb.lnk")) returned 0xffffffff [0219.364] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b5dd90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b5dd90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="ib7119orINUW2lSKZX.lnk", cAlternateFileName="IB7119~1.LNK")) returned 1 [0219.365] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0219.365] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.365] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0219.365] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0219.365] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0219.365] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.365] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0219.366] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0219.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ib7119orINUW2lSKZX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ib7119orinuw2lskzx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0219.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6962373131396F72494E5557326C534B5A58.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6962373131396f72494e5557326c534b5a58.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0219.367] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa73 [0219.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0219.367] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0219.476] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa73, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa73, lpOverlapped=0x0) returned 1 [0219.477] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa80, lpOverlapped=0x0) returned 1 [0219.478] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.501] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.512] CloseHandle (hObject=0x104) returned 1 [0219.512] CloseHandle (hObject=0x10c) returned 1 [0219.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ib7119orINUW2lSKZX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ib7119orinuw2lskzx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6962373131396F72494E5557326C534B5A58.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6962373131396f72494e5557326c534b5a58.lnk")) returned 0 [0219.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6962373131396F72494E5557326C534B5A58.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6962373131396f72494e5557326c534b5a58.lnk")) returned 0x20 [0219.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ib7119orINUW2lSKZX.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b5dd90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b5dd90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ib7119orINUW2lSKZX.lnk", cAlternateFileName="IB7119~1.LNK")) returned 0x325018 [0219.513] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b5dd90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b5dd90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ib7119orINUW2lSKZX.lnk", cAlternateFileName="IB7119~1.LNK")) returned 0 [0219.513] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0219.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ib7119orINUW2lSKZX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ib7119orinuw2lskzx.lnk")) returned 1 [0219.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ib7119orINUW2lSKZX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ib7119orinuw2lskzx.lnk")) returned 0xffffffff [0219.514] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14749d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x19e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Ifn0s4Jt.lnk", cAlternateFileName="")) returned 1 [0219.515] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0219.515] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.515] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0219.515] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0219.516] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0219.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0219.516] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0219.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ifn0s4Jt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ifn0s4jt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0219.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\49666E3073344A74.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\49666e3073344a74.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0219.517] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e3 [0219.517] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0219.518] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0219.610] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x19e3, lpOverlapped=0x0) returned 1 [0219.611] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x19f0, lpOverlapped=0x0) returned 1 [0219.612] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.634] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.645] CloseHandle (hObject=0x10c) returned 1 [0219.645] CloseHandle (hObject=0x104) returned 1 [0219.645] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ifn0s4Jt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ifn0s4jt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\49666E3073344A74.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\49666e3073344a74.lnk")) returned 0 [0219.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\49666E3073344A74.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\49666e3073344a74.lnk")) returned 0x20 [0219.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ifn0s4Jt.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14749d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x19e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Ifn0s4Jt.lnk", cAlternateFileName="")) returned 0x325018 [0219.647] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14749d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x19e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Ifn0s4Jt.lnk", cAlternateFileName="")) returned 0 [0219.647] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0219.647] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ifn0s4Jt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ifn0s4jt.lnk")) returned 1 [0219.648] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ifn0s4Jt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ifn0s4jt.lnk")) returned 0xffffffff [0219.648] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f50e30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f50e30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f50e30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdLJ8ERzrO7p5 F.lnk", cAlternateFileName="JDLJ8E~1.LNK")) returned 1 [0219.648] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0219.648] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.648] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0219.648] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0219.649] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0219.649] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.649] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0219.649] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0219.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdLJ8ERzrO7p5 F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jdlj8erzro7p5 f.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0219.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6A644C4A3845527A724F3770352046.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6a644c4a3845527a724f3770352046.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0219.650] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6e [0219.650] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0219.651] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0219.739] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa6e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa6e, lpOverlapped=0x0) returned 1 [0219.740] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa70, lpOverlapped=0x0) returned 1 [0219.741] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.763] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.774] CloseHandle (hObject=0x104) returned 1 [0219.774] CloseHandle (hObject=0x10c) returned 1 [0219.775] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdLJ8ERzrO7p5 F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jdlj8erzro7p5 f.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6A644C4A3845527A724F3770352046.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6a644c4a3845527a724f3770352046.lnk")) returned 0 [0219.775] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6A644C4A3845527A724F3770352046.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6a644c4a3845527a724f3770352046.lnk")) returned 0x20 [0219.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdLJ8ERzrO7p5 F.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f50e30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f50e30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f50e30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="jdLJ8ERzrO7p5 F.lnk", cAlternateFileName="JDLJ8E~1.LNK")) returned 0x325018 [0219.776] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f50e30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f50e30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f50e30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="jdLJ8ERzrO7p5 F.lnk", cAlternateFileName="JDLJ8E~1.LNK")) returned 0 [0219.776] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0219.776] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdLJ8ERzrO7p5 F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jdlj8erzro7p5 f.lnk")) returned 1 [0219.777] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdLJ8ERzrO7p5 F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jdlj8erzro7p5 f.lnk")) returned 0xffffffff [0219.777] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21fe6f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa21fe6f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21fe6f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jeAQDeqHkc.lnk", cAlternateFileName="JEAQDE~1.LNK")) returned 1 [0219.777] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0219.777] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.777] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0219.777] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0219.778] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0219.778] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.778] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0219.778] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0219.778] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jeAQDeqHkc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jeaqdeqhkc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0219.778] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6A654151446571486B63.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6a654151446571486b63.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0219.779] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d0 [0219.779] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0219.779] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0219.852] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x13d0, lpOverlapped=0x0) returned 1 [0219.853] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x13e0, lpOverlapped=0x0) returned 1 [0219.854] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.884] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.895] CloseHandle (hObject=0x10c) returned 1 [0219.895] CloseHandle (hObject=0x104) returned 1 [0219.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jeAQDeqHkc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jeaqdeqhkc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6A654151446571486B63.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6a654151446571486b63.lnk")) returned 0 [0219.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6A654151446571486B63.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6a654151446571486b63.lnk")) returned 0x20 [0219.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jeAQDeqHkc.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21fe6f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa21fe6f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21fe6f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="jeAQDeqHkc.lnk", cAlternateFileName="JEAQDE~1.LNK")) returned 0x325018 [0219.897] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21fe6f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa21fe6f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21fe6f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="jeAQDeqHkc.lnk", cAlternateFileName="JEAQDE~1.LNK")) returned 0 [0219.897] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0219.897] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jeAQDeqHkc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jeaqdeqhkc.lnk")) returned 1 [0219.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jeAQDeqHkc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jeaqdeqhkc.lnk")) returned 0xffffffff [0219.898] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fae570, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="JvjAhDI.lnk", cAlternateFileName="")) returned 1 [0219.899] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0219.899] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.899] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0219.899] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0219.899] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0219.899] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0219.899] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0219.899] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0219.900] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JvjAhDI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jvjahdi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0219.900] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4A766A41684449.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4a766a41684449.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0219.901] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f6 [0219.901] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0219.901] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0219.991] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9f6, lpOverlapped=0x0) returned 1 [0219.992] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0219.993] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.015] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.025] CloseHandle (hObject=0x104) returned 1 [0220.025] CloseHandle (hObject=0x10c) returned 1 [0220.026] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JvjAhDI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jvjahdi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4A766A41684449.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4a766a41684449.lnk")) returned 0 [0220.027] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4A766A41684449.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4a766a41684449.lnk")) returned 0x20 [0220.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JvjAhDI.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fae570, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="JvjAhDI.lnk", cAlternateFileName="")) returned 0x325018 [0220.027] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fae570, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="JvjAhDI.lnk", cAlternateFileName="")) returned 0 [0220.027] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0220.027] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JvjAhDI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jvjahdi.lnk")) returned 1 [0220.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JvjAhDI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jvjahdi.lnk")) returned 0xffffffff [0220.028] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2485e50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2485e50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2485e50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k4LdStwZUf2nTw6.lnk", cAlternateFileName="K4LDST~1.LNK")) returned 1 [0220.028] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0220.028] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.028] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0220.028] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0220.029] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0220.029] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.029] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a8) returned 0x10ab [0220.029] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0220.029] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4LdStwZUf2nTw6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k4ldstwzuf2ntw6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0220.029] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B344C645374775A5566326E547736.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b344c645374775a5566326e547736.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0220.031] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa4e [0220.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0220.031] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0220.123] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa4e, lpOverlapped=0x0) returned 1 [0220.124] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa50, lpOverlapped=0x0) returned 1 [0220.125] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.147] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.158] CloseHandle (hObject=0x10c) returned 1 [0220.158] CloseHandle (hObject=0x104) returned 1 [0220.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4LdStwZUf2nTw6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k4ldstwzuf2ntw6.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B344C645374775A5566326E547736.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b344c645374775a5566326e547736.lnk")) returned 0 [0220.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B344C645374775A5566326E547736.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b344c645374775a5566326e547736.lnk")) returned 0x20 [0220.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4LdStwZUf2nTw6.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2485e50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2485e50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2485e50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="k4LdStwZUf2nTw6.lnk", cAlternateFileName="K4LDST~1.LNK")) returned 0x325018 [0220.159] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2485e50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2485e50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2485e50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="k4LdStwZUf2nTw6.lnk", cAlternateFileName="K4LDST~1.LNK")) returned 0 [0220.159] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0220.159] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4LdStwZUf2nTw6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k4ldstwzuf2ntw6.lnk")) returned 1 [0220.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4LdStwZUf2nTw6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k4ldstwzuf2ntw6.lnk")) returned 0xffffffff [0220.160] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14749d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa14749d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa14749d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2129, dwReserved0=0x0, dwReserved1=0x0, cFileName="k5veOf0IesLx.lnk", cAlternateFileName="K5VEOF~1.LNK")) returned 1 [0220.161] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0220.161] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.161] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0220.161] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0220.161] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b03c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0220.161] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.161] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b03c) returned 0x10ab [0220.161] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0220.161] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k5veOf0IesLx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k5veof0ieslx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0220.161] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B3576654F66304965734C78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b3576654f66304965734c78.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0220.163] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2129 [0220.163] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0220.163] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0220.249] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2129, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2129, lpOverlapped=0x0) returned 1 [0220.249] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2130, lpOverlapped=0x0) returned 1 [0220.250] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.277] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.288] CloseHandle (hObject=0x104) returned 1 [0220.288] CloseHandle (hObject=0x10c) returned 1 [0220.288] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k5veOf0IesLx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k5veof0ieslx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B3576654F66304965734C78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b3576654f66304965734c78.lnk")) returned 0 [0220.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B3576654F66304965734C78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b3576654f66304965734c78.lnk")) returned 0x20 [0220.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k5veOf0IesLx.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14749d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa14749d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa14749d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2129, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="k5veOf0IesLx.lnk", cAlternateFileName="K5VEOF~1.LNK")) returned 0x325018 [0220.289] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14749d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa14749d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa14749d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2129, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="k5veOf0IesLx.lnk", cAlternateFileName="K5VEOF~1.LNK")) returned 0 [0220.289] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0220.289] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k5veOf0IesLx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k5veof0ieslx.lnk")) returned 1 [0220.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k5veOf0IesLx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k5veof0ieslx.lnk")) returned 0xffffffff [0220.290] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15cb630, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa15cb630, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa15cb630, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2104, dwReserved0=0x0, dwReserved1=0x0, cFileName="kICtw75iUSE4jdT.lnk", cAlternateFileName="KICTW7~1.LNK")) returned 1 [0220.291] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0220.291] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0220.291] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0220.291] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b03c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0220.291] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b03c) returned 0x10ab [0220.291] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0220.291] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kICtw75iUSE4jdT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kictw75iuse4jdt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0220.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B49437477373569555345346A6454.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b49437477373569555345346a6454.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0220.296] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2104 [0220.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0220.296] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0220.370] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2104, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2104, lpOverlapped=0x0) returned 1 [0220.371] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2110, lpOverlapped=0x0) returned 1 [0220.372] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.433] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.444] CloseHandle (hObject=0x10c) returned 1 [0220.444] CloseHandle (hObject=0x104) returned 1 [0220.444] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kICtw75iUSE4jdT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kictw75iuse4jdt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B49437477373569555345346A6454.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b49437477373569555345346a6454.lnk")) returned 0 [0220.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B49437477373569555345346A6454.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b49437477373569555345346a6454.lnk")) returned 0x20 [0220.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kICtw75iUSE4jdT.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15cb630, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa15cb630, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa15cb630, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2104, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="kICtw75iUSE4jdT.lnk", cAlternateFileName="KICTW7~1.LNK")) returned 0x325018 [0220.445] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15cb630, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa15cb630, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa15cb630, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2104, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="kICtw75iUSE4jdT.lnk", cAlternateFileName="KICTW7~1.LNK")) returned 0 [0220.445] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0220.445] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kICtw75iUSE4jdT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kictw75iuse4jdt.lnk")) returned 1 [0220.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kICtw75iUSE4jdT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kictw75iuse4jdt.lnk")) returned 0xffffffff [0220.446] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29e0fd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29e0fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29e0fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkCWrV.lnk", cAlternateFileName="")) returned 1 [0220.447] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0220.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0220.447] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0220.447] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0220.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0220.447] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0220.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kkCWrV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kkcwrv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0220.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B6B43577256.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b6b43577256.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0220.449] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb1 [0220.449] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0220.449] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0220.520] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xeb1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xeb1, lpOverlapped=0x0) returned 1 [0220.521] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xec0, lpOverlapped=0x0) returned 1 [0220.521] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.544] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.554] CloseHandle (hObject=0x104) returned 1 [0220.555] CloseHandle (hObject=0x10c) returned 1 [0220.555] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kkCWrV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kkcwrv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B6B43577256.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b6b43577256.lnk")) returned 0 [0220.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6B6B43577256.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b6b43577256.lnk")) returned 0x20 [0220.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kkCWrV.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29e0fd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29e0fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29e0fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeb1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="kkCWrV.lnk", cAlternateFileName="")) returned 0x325018 [0220.556] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29e0fd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29e0fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29e0fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeb1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="kkCWrV.lnk", cAlternateFileName="")) returned 0 [0220.556] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0220.556] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kkCWrV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kkcwrv.lnk")) returned 1 [0220.557] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kkCWrV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kkcwrv.lnk")) returned 0xffffffff [0220.557] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16afe70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16afe70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="L50JZ2YINIpc_oEnbW-.lnk", cAlternateFileName="L50JZ2~1.LNK")) returned 1 [0220.557] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0220.557] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.557] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0220.557] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0220.557] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0220.557] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.557] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0220.558] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0220.558] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L50JZ2YINIpc_oEnbW-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l50jz2yinipc_oenbw-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0220.558] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C35304A5A3259494E4970635F6F456E62572D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c35304a5a3259494e4970635f6f456e62572d.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0220.559] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a7 [0220.559] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0220.559] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0220.646] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3a7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3a7, lpOverlapped=0x0) returned 1 [0220.647] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3b0, lpOverlapped=0x0) returned 1 [0220.648] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.675] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.686] CloseHandle (hObject=0x10c) returned 1 [0220.686] CloseHandle (hObject=0x104) returned 1 [0220.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L50JZ2YINIpc_oEnbW-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l50jz2yinipc_oenbw-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C35304A5A3259494E4970635F6F456E62572D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c35304a5a3259494e4970635f6f456e62572d.lnk")) returned 0 [0220.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C35304A5A3259494E4970635F6F456E62572D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c35304a5a3259494e4970635f6f456e62572d.lnk")) returned 0x20 [0220.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L50JZ2YINIpc_oEnbW-.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16afe70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16afe70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="L50JZ2YINIpc_oEnbW-.lnk", cAlternateFileName="L50JZ2~1.LNK")) returned 0x325018 [0220.687] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16afe70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16afe70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16afe70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="L50JZ2YINIpc_oEnbW-.lnk", cAlternateFileName="L50JZ2~1.LNK")) returned 0 [0220.687] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0220.687] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L50JZ2YINIpc_oEnbW-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l50jz2yinipc_oenbw-.lnk")) returned 1 [0220.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L50JZ2YINIpc_oEnbW-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l50jz2yinipc_oenbw-.lnk")) returned 0xffffffff [0220.688] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa296ebb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa296ebb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa296ebb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="L86hkcM.mkv.lnk", cAlternateFileName="L86HKC~1.LNK")) returned 1 [0220.689] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0220.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0220.689] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0220.690] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0c0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0220.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0c0) returned 0x10ab [0220.690] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0220.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L86hkcM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l86hkcm.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0220.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C3836686B634D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c3836686b634d2e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0220.691] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e1 [0220.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0220.692] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0220.779] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3e1, lpOverlapped=0x0) returned 1 [0220.780] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0220.781] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.803] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.813] CloseHandle (hObject=0x104) returned 1 [0220.813] CloseHandle (hObject=0x10c) returned 1 [0220.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L86hkcM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l86hkcm.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C3836686B634D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c3836686b634d2e6d6b76.lnk")) returned 0 [0220.814] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C3836686B634D2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c3836686b634d2e6d6b76.lnk")) returned 0x20 [0220.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L86hkcM.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa296ebb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa296ebb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa296ebb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="L86hkcM.mkv.lnk", cAlternateFileName="L86HKC~1.LNK")) returned 0x325018 [0220.815] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa296ebb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa296ebb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa296ebb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="L86hkcM.mkv.lnk", cAlternateFileName="L86HKC~1.LNK")) returned 0 [0220.815] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0220.815] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L86hkcM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l86hkcm.mkv.lnk")) returned 1 [0220.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L86hkcM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l86hkcm.mkv.lnk")) returned 0xffffffff [0220.816] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24f8270, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24f8270, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24f8270, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="LPtT U69.lnk", cAlternateFileName="LPTTU6~1.LNK")) returned 1 [0220.816] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0220.816] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.816] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0220.816] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0220.817] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0220.817] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.817] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0220.817] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0220.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LPtT U69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lptt u69.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0220.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C50745420553639.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c50745420553639.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0220.818] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa05 [0220.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0220.819] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0220.890] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa05, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa05, lpOverlapped=0x0) returned 1 [0220.891] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa10, lpOverlapped=0x0) returned 1 [0220.892] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.914] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.926] CloseHandle (hObject=0x10c) returned 1 [0220.926] CloseHandle (hObject=0x104) returned 1 [0220.927] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LPtT U69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lptt u69.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C50745420553639.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c50745420553639.lnk")) returned 0 [0220.927] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4C50745420553639.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4c50745420553639.lnk")) returned 0x20 [0220.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LPtT U69.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24f8270, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24f8270, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24f8270, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="LPtT U69.lnk", cAlternateFileName="LPTTU6~1.LNK")) returned 0x325018 [0220.928] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24f8270, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24f8270, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24f8270, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="LPtT U69.lnk", cAlternateFileName="LPTTU6~1.LNK")) returned 0 [0220.928] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0220.928] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LPtT U69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lptt u69.lnk")) returned 1 [0220.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LPtT U69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lptt u69.lnk")) returned 0xffffffff [0220.929] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1a8e230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MBiev-Uf1Xp.lnk", cAlternateFileName="MBIEV-~1.LNK")) returned 1 [0220.929] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0220.929] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.929] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0220.929] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0220.930] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0220.930] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0220.930] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0220.930] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0220.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MBiev-Uf1Xp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mbiev-uf1xp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0220.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D426965762D5566315870.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d426965762d5566315870.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0220.931] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ae [0220.931] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0220.932] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0221.024] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9ae, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9ae, lpOverlapped=0x0) returned 1 [0221.025] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x9b0, lpOverlapped=0x0) returned 1 [0221.027] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.050] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.060] CloseHandle (hObject=0x104) returned 1 [0221.061] CloseHandle (hObject=0x10c) returned 1 [0221.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MBiev-Uf1Xp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mbiev-uf1xp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D426965762D5566315870.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d426965762d5566315870.lnk")) returned 0 [0221.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D426965762D5566315870.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d426965762d5566315870.lnk")) returned 0x20 [0221.063] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MBiev-Uf1Xp.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1a8e230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9ae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MBiev-Uf1Xp.lnk", cAlternateFileName="MBIEV-~1.LNK")) returned 0x325018 [0221.063] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1a8e230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9ae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MBiev-Uf1Xp.lnk", cAlternateFileName="MBIEV-~1.LNK")) returned 0 [0221.063] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0221.063] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MBiev-Uf1Xp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mbiev-uf1xp.lnk")) returned 1 [0221.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MBiev-Uf1Xp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mbiev-uf1xp.lnk")) returned 0xffffffff [0221.064] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15a54d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa15a54d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa15a54d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2130, dwReserved0=0x0, dwReserved1=0x0, cFileName="mDJcw8J1YJRg m5r5L.lnk", cAlternateFileName="MDJCW8~1.LNK")) returned 1 [0221.065] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0221.065] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.065] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0221.065] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0221.066] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b06c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0221.066] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.066] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b06c) returned 0x10ab [0221.066] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0221.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mDJcw8J1YJRg m5r5L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mdjcw8j1yjrg m5r5l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0221.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6D444A6377384A31594A5267206D3572354C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6d444a6377384a31594a5267206d3572354c.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0221.068] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2130 [0221.068] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0221.068] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0221.158] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2130, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2130, lpOverlapped=0x0) returned 1 [0221.158] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2140, lpOverlapped=0x0) returned 1 [0221.160] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.182] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.193] CloseHandle (hObject=0x10c) returned 1 [0221.193] CloseHandle (hObject=0x104) returned 1 [0221.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mDJcw8J1YJRg m5r5L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mdjcw8j1yjrg m5r5l.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6D444A6377384A31594A5267206D3572354C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6d444a6377384a31594a5267206d3572354c.lnk")) returned 0 [0221.194] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6D444A6377384A31594A5267206D3572354C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6d444a6377384a31594a5267206d3572354c.lnk")) returned 0x20 [0221.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mDJcw8J1YJRg m5r5L.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15a54d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa15a54d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa15a54d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2130, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="mDJcw8J1YJRg m5r5L.lnk", cAlternateFileName="MDJCW8~1.LNK")) returned 0x325018 [0221.194] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15a54d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa15a54d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa15a54d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2130, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="mDJcw8J1YJRg m5r5L.lnk", cAlternateFileName="MDJCW8~1.LNK")) returned 0 [0221.194] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0221.194] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mDJcw8J1YJRg m5r5L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mdjcw8j1yjrg m5r5l.lnk")) returned 1 [0221.195] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mDJcw8J1YJRg m5r5L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mdjcw8j1yjrg m5r5l.lnk")) returned 0xffffffff [0221.195] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa232f1f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa232f1f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa232f1f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe9b, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="MnXu.lnk", cAlternateFileName="")) returned 1 [0221.196] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0221.196] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.196] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0221.196] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0221.197] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b06c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0221.197] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.197] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b06c) returned 0x10ab [0221.197] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0221.197] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MnXu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnxu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0221.197] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D6E5875.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d6e5875.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0221.198] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9b [0221.198] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0221.199] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0221.287] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe9b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe9b, lpOverlapped=0x0) returned 1 [0221.287] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xea0, lpOverlapped=0x0) returned 1 [0221.289] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.311] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.322] CloseHandle (hObject=0x104) returned 1 [0221.322] CloseHandle (hObject=0x10c) returned 1 [0221.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MnXu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnxu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D6E5875.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d6e5875.lnk")) returned 0 [0221.323] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D6E5875.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d6e5875.lnk")) returned 0x20 [0221.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MnXu.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa232f1f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa232f1f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa232f1f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe9b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MnXu.lnk", cAlternateFileName="")) returned 0x325018 [0221.324] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa232f1f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa232f1f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa232f1f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe9b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MnXu.lnk", cAlternateFileName="")) returned 0 [0221.324] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0221.324] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MnXu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnxu.lnk")) returned 1 [0221.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MnXu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnxu.lnk")) returned 0xffffffff [0221.325] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x128d, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Moiok07T2Jx.lnk", cAlternateFileName="MOIOK0~1.LNK")) returned 1 [0221.326] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0221.326] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0221.326] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0221.326] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b09c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0221.326] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b09c) returned 0x10ab [0221.326] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0221.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Moiok07T2Jx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moiok07t2jx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0221.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D6F696F6B303754324A78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d6f696f6b303754324a78.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0221.328] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x128d [0221.328] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0221.328] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0221.477] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x128d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x128d, lpOverlapped=0x0) returned 1 [0221.478] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1290, lpOverlapped=0x0) returned 1 [0221.479] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.502] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.513] CloseHandle (hObject=0x10c) returned 1 [0221.513] CloseHandle (hObject=0x104) returned 1 [0221.513] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Moiok07T2Jx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moiok07t2jx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D6F696F6B303754324A78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d6f696f6b303754324a78.lnk")) returned 0 [0221.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D6F696F6B303754324A78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d6f696f6b303754324a78.lnk")) returned 0x20 [0221.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Moiok07T2Jx.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x128d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Moiok07T2Jx.lnk", cAlternateFileName="MOIOK0~1.LNK")) returned 0x325018 [0221.514] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d4cf70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d4cf70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x128d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Moiok07T2Jx.lnk", cAlternateFileName="MOIOK0~1.LNK")) returned 0 [0221.514] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0221.514] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Moiok07T2Jx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moiok07t2jx.lnk")) returned 1 [0221.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Moiok07T2Jx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moiok07t2jx.lnk")) returned 0xffffffff [0221.515] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12133d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 1 [0221.516] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0221.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0221.516] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0221.516] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b054, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0221.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b054) returned 0x10ab [0221.516] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0221.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0221.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D79204D75736963.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d79204d75736963.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0221.518] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52a [0221.518] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0221.518] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0221.599] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x52a, lpOverlapped=0x0) returned 1 [0221.600] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x530, lpOverlapped=0x0) returned 1 [0221.601] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.624] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.634] CloseHandle (hObject=0x104) returned 1 [0221.634] CloseHandle (hObject=0x10c) returned 1 [0221.634] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D79204D75736963.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d79204d75736963.lnk")) returned 0 [0221.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D79204D75736963.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d79204d75736963.lnk")) returned 0x20 [0221.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12133d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 0x325018 [0221.635] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12133d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 0 [0221.635] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0221.635] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 1 [0221.636] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 0xffffffff [0221.636] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1343ed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 1 [0221.637] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0221.637] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.637] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0221.638] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0221.638] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b054, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0221.638] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.638] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b054) returned 0x10ab [0221.638] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0221.638] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0221.638] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D79205069637475726573.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d79205069637475726573.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0221.639] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54f [0221.639] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0221.640] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0221.740] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x54f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x54f, lpOverlapped=0x0) returned 1 [0221.742] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x550, lpOverlapped=0x0) returned 1 [0221.744] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.767] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.778] CloseHandle (hObject=0x10c) returned 1 [0221.779] CloseHandle (hObject=0x104) returned 1 [0221.779] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D79205069637475726573.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d79205069637475726573.lnk")) returned 0 [0221.781] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D79205069637475726573.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d79205069637475726573.lnk")) returned 0x20 [0221.781] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1343ed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 0x325018 [0221.781] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1343ed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2fae570, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2fae570, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 0 [0221.781] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0221.781] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 1 [0221.782] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 0xffffffff [0221.782] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f04b70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 1 [0221.783] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0221.783] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.783] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0221.783] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0221.784] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0221.784] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.784] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0221.784] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0221.784] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0221.784] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D7920566964656F73.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d7920566964656f73.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0221.786] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x539 [0221.786] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0221.786] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0221.875] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x539, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x539, lpOverlapped=0x0) returned 1 [0221.876] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x540, lpOverlapped=0x0) returned 1 [0221.877] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.900] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.912] CloseHandle (hObject=0x104) returned 1 [0221.912] CloseHandle (hObject=0x10c) returned 1 [0221.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D7920566964656F73.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d7920566964656f73.lnk")) returned 0 [0221.913] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4D7920566964656F73.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4d7920566964656f73.lnk")) returned 0x20 [0221.913] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f04b70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 0x325018 [0221.913] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f04b70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 0 [0221.913] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0221.913] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 1 [0221.914] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 0xffffffff [0221.914] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24f8270, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24f8270, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24f8270, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="n0yb.lnk", cAlternateFileName="")) returned 1 [0221.915] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0221.915] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.915] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0221.915] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0221.915] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0221.915] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0221.915] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0221.915] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0221.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n0yb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0yb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0221.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6E307962.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6e307962.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0221.917] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d5 [0221.917] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0221.917] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0222.005] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9d5, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9d5, lpOverlapped=0x0) returned 1 [0222.006] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x9e0, lpOverlapped=0x0) returned 1 [0222.007] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.029] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.040] CloseHandle (hObject=0x10c) returned 1 [0222.040] CloseHandle (hObject=0x104) returned 1 [0222.040] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n0yb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0yb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6E307962.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6e307962.lnk")) returned 0 [0222.041] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6E307962.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6e307962.lnk")) returned 0x20 [0222.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n0yb.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24f8270, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24f8270, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24f8270, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="n0yb.lnk", cAlternateFileName="")) returned 0x325018 [0222.041] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24f8270, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24f8270, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24f8270, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="n0yb.lnk", cAlternateFileName="")) returned 0 [0222.041] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0222.041] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n0yb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0yb.lnk")) returned 1 [0222.043] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n0yb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0yb.lnk")) returned 0xffffffff [0222.043] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1a8e230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1a8e230, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1a8e230, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xf3c, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Ncz2LXK7bFvUl6.lnk", cAlternateFileName="NCZ2LX~1.LNK")) returned 1 [0222.043] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0222.043] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.043] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0222.043] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0222.044] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b094, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0222.044] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.044] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b094) returned 0x10ab [0222.044] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0222.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ncz2LXK7bFvUl6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ncz2lxk7bfvul6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0222.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4E637A324C584B37624676556C36.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4e637a324c584b37624676556c36.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0222.045] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3c [0222.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0222.046] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0222.125] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf3c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xf3c, lpOverlapped=0x0) returned 1 [0222.126] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf40, lpOverlapped=0x0) returned 1 [0222.127] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.149] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.160] CloseHandle (hObject=0x104) returned 1 [0222.160] CloseHandle (hObject=0x10c) returned 1 [0222.160] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ncz2LXK7bFvUl6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ncz2lxk7bfvul6.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4E637A324C584B37624676556C36.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4e637a324c584b37624676556c36.lnk")) returned 0 [0222.161] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4E637A324C584B37624676556C36.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4e637a324c584b37624676556c36.lnk")) returned 0x20 [0222.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ncz2LXK7bFvUl6.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1a8e230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1a8e230, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1a8e230, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xf3c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Ncz2LXK7bFvUl6.lnk", cAlternateFileName="NCZ2LX~1.LNK")) returned 0x325018 [0222.161] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1a8e230, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1a8e230, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1a8e230, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xf3c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Ncz2LXK7bFvUl6.lnk", cAlternateFileName="NCZ2LX~1.LNK")) returned 0 [0222.161] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0222.162] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ncz2LXK7bFvUl6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ncz2lxk7bfvul6.lnk")) returned 1 [0222.162] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ncz2LXK7bFvUl6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ncz2lxk7bfvul6.lnk")) returned 0xffffffff [0222.163] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14e6df0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e0b650, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e0b650, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="o5_2ORo mnaFJ7QP.lnk", cAlternateFileName="O5_2OR~1.LNK")) returned 1 [0222.163] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0222.163] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.163] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0222.163] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0222.164] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b024, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0222.164] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.164] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b024) returned 0x10ab [0222.164] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0222.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o5_2ORo mnaFJ7QP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o5_2oro mnafj7qp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0222.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6F355F324F526F206D6E61464A375150.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6f355f324f526f206d6e61464a375150.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0222.165] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e37 [0222.166] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0222.166] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0222.253] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e37, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1e37, lpOverlapped=0x0) returned 1 [0222.254] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e40, lpOverlapped=0x0) returned 1 [0222.255] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.277] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.287] CloseHandle (hObject=0x10c) returned 1 [0222.287] CloseHandle (hObject=0x104) returned 1 [0222.287] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o5_2ORo mnaFJ7QP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o5_2oro mnafj7qp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6F355F324F526F206D6E61464A375150.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6f355f324f526f206d6e61464a375150.lnk")) returned 0 [0222.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6F355F324F526F206D6E61464A375150.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6f355f324f526f206d6e61464a375150.lnk")) returned 0x20 [0222.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o5_2ORo mnaFJ7QP.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14e6df0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e0b650, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e0b650, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1e37, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="o5_2ORo mnaFJ7QP.lnk", cAlternateFileName="O5_2OR~1.LNK")) returned 0x325018 [0222.289] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14e6df0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e0b650, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e0b650, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1e37, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="o5_2ORo mnaFJ7QP.lnk", cAlternateFileName="O5_2OR~1.LNK")) returned 0 [0222.289] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0222.289] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o5_2ORo mnaFJ7QP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o5_2oro mnafj7qp.lnk")) returned 1 [0222.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o5_2ORo mnaFJ7QP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o5_2oro mnafj7qp.lnk")) returned 0xffffffff [0222.290] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29228f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29228f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29228f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="O8wp5.lnk", cAlternateFileName="")) returned 1 [0222.290] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0222.290] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.290] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0222.290] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0222.291] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0222.291] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.291] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0222.291] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0222.291] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O8wp5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o8wp5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0222.291] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F38777035.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f38777035.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0222.292] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9dc [0222.292] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0222.293] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0222.385] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9dc, lpOverlapped=0x0) returned 1 [0222.402] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x9e0, lpOverlapped=0x0) returned 1 [0222.403] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.425] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.445] CloseHandle (hObject=0x104) returned 1 [0222.445] CloseHandle (hObject=0x10c) returned 1 [0222.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O8wp5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o8wp5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F38777035.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f38777035.lnk")) returned 0 [0222.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F38777035.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f38777035.lnk")) returned 0x20 [0222.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O8wp5.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29228f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29228f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29228f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="O8wp5.lnk", cAlternateFileName="")) returned 0x325018 [0222.446] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29228f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29228f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29228f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="O8wp5.lnk", cAlternateFileName="")) returned 0 [0222.446] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0222.446] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O8wp5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o8wp5.lnk")) returned 1 [0222.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O8wp5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o8wp5.lnk")) returned 0xffffffff [0222.447] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28d6630, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28d6630, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28d6630, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFcQA_k0GGF.lnk", cAlternateFileName="OFCQA_~1.LNK")) returned 1 [0222.448] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0222.448] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.448] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0222.448] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0222.449] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0222.449] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.449] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0222.449] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0222.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oFcQA_k0GGF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofcqa_k0ggf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0222.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6F466351415F6B30474746.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6f466351415f6b30474746.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0222.450] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0222.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0222.451] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0222.528] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa42, lpOverlapped=0x0) returned 1 [0222.529] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa50, lpOverlapped=0x0) returned 1 [0222.530] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.552] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.563] CloseHandle (hObject=0x10c) returned 1 [0222.563] CloseHandle (hObject=0x104) returned 1 [0222.563] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oFcQA_k0GGF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofcqa_k0ggf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6F466351415F6B30474746.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6f466351415f6b30474746.lnk")) returned 0 [0222.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6F466351415F6B30474746.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6f466351415f6b30474746.lnk")) returned 0x20 [0222.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oFcQA_k0GGF.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28d6630, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28d6630, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28d6630, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="oFcQA_k0GGF.lnk", cAlternateFileName="OFCQA_~1.LNK")) returned 0x325018 [0222.564] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28d6630, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28d6630, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28d6630, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="oFcQA_k0GGF.lnk", cAlternateFileName="OFCQA_~1.LNK")) returned 0 [0222.564] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0222.564] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oFcQA_k0GGF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofcqa_k0ggf.lnk")) returned 1 [0222.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oFcQA_k0GGF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofcqa_k0ggf.lnk")) returned 0xffffffff [0222.565] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16d5fd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16d5fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16d5fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFXakhyrmuuC1X.lnk", cAlternateFileName="OFXAKH~1.LNK")) returned 1 [0222.566] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0222.566] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.566] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0222.566] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0222.566] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0222.566] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.566] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0222.566] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0222.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OFXakhyrmuuC1X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofxakhyrmuuc1x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0222.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F4658616B6879726D7575433158.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f4658616b6879726d7575433158.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0222.568] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa63 [0222.568] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0222.568] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0222.668] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa63, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa63, lpOverlapped=0x0) returned 1 [0222.669] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa70, lpOverlapped=0x0) returned 1 [0222.672] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.694] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.708] CloseHandle (hObject=0x104) returned 1 [0222.708] CloseHandle (hObject=0x10c) returned 1 [0222.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OFXakhyrmuuC1X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofxakhyrmuuc1x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F4658616B6879726D7575433158.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f4658616b6879726d7575433158.lnk")) returned 0 [0222.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F4658616B6879726D7575433158.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f4658616b6879726d7575433158.lnk")) returned 0x20 [0222.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OFXakhyrmuuC1X.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16d5fd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16d5fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16d5fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="OFXakhyrmuuC1X.lnk", cAlternateFileName="OFXAKH~1.LNK")) returned 0x325018 [0222.711] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16d5fd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa16d5fd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16d5fd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="OFXakhyrmuuC1X.lnk", cAlternateFileName="OFXAKH~1.LNK")) returned 0 [0222.711] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0222.711] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OFXakhyrmuuC1X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofxakhyrmuuc1x.lnk")) returned 1 [0222.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OFXakhyrmuuC1X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofxakhyrmuuc1x.lnk")) returned 0xffffffff [0222.713] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e317b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e317b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e317b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOhh2MRGXT.lnk", cAlternateFileName="OOHH2M~1.LNK")) returned 1 [0222.716] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0222.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.718] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0222.718] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0222.718] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0222.718] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.718] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0222.719] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0222.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOhh2MRGXT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oohh2mrgxt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0222.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F4F6868324D52475854.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f4f6868324d52475854.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0222.720] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145e [0222.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0222.720] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0222.810] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x145e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x145e, lpOverlapped=0x0) returned 1 [0222.811] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1460, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1460, lpOverlapped=0x0) returned 1 [0222.812] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.835] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.846] CloseHandle (hObject=0x10c) returned 1 [0222.846] CloseHandle (hObject=0x104) returned 1 [0222.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOhh2MRGXT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oohh2mrgxt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F4F6868324D52475854.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f4f6868324d52475854.lnk")) returned 0 [0222.847] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4F4F6868324D52475854.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4f4f6868324d52475854.lnk")) returned 0x20 [0222.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOhh2MRGXT.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e317b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e317b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e317b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="OOhh2MRGXT.lnk", cAlternateFileName="OOHH2M~1.LNK")) returned 0x325018 [0222.847] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e317b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e317b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e317b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="OOhh2MRGXT.lnk", cAlternateFileName="OOHH2M~1.LNK")) returned 0 [0222.847] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0222.847] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOhh2MRGXT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oohh2mrgxt.lnk")) returned 1 [0222.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOhh2MRGXT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oohh2mrgxt.lnk")) returned 0xffffffff [0222.848] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1eb88b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1eb88b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1eb88b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="pFu6CZz1vM53t7xxt.lnk", cAlternateFileName="PFU6CZ~1.LNK")) returned 1 [0222.849] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0222.849] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.849] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0222.849] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0222.850] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0222.850] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.850] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0222.850] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0222.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pFu6CZz1vM53t7xxt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pfu6czz1vm53t7xxt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0222.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\70467536435A7A31764D35337437787874.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\70467536435a7a31764d35337437787874.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0222.851] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x415 [0222.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0222.851] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0222.925] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x415, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x415, lpOverlapped=0x0) returned 1 [0222.926] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x420, lpOverlapped=0x0) returned 1 [0222.927] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.950] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.960] CloseHandle (hObject=0x104) returned 1 [0222.961] CloseHandle (hObject=0x10c) returned 1 [0222.961] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pFu6CZz1vM53t7xxt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pfu6czz1vm53t7xxt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\70467536435A7A31764D35337437787874.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\70467536435a7a31764d35337437787874.lnk")) returned 0 [0222.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\70467536435A7A31764D35337437787874.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\70467536435a7a31764d35337437787874.lnk")) returned 0x20 [0222.962] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pFu6CZz1vM53t7xxt.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1eb88b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1eb88b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1eb88b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="pFu6CZz1vM53t7xxt.lnk", cAlternateFileName="PFU6CZ~1.LNK")) returned 0x325018 [0222.962] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1eb88b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1eb88b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1eb88b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="pFu6CZz1vM53t7xxt.lnk", cAlternateFileName="PFU6CZ~1.LNK")) returned 0 [0222.962] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0222.962] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pFu6CZz1vM53t7xxt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pfu6czz1vm53t7xxt.lnk")) returned 1 [0222.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pFu6CZz1vM53t7xxt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pfu6czz1vm53t7xxt.lnk")) returned 0xffffffff [0222.963] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cdab50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xf10, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="q403s_jhOF.lnk", cAlternateFileName="Q403S_~1.LNK")) returned 1 [0222.964] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0222.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0222.964] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0222.964] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0222.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0222.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b0) returned 0x10ab [0222.965] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0222.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q403s_jhOF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q403s_jhof.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0222.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71343033735F6A684F46.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71343033735f6a684f46.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0222.966] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf10 [0222.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0222.966] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0223.053] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf10, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xf10, lpOverlapped=0x0) returned 1 [0223.053] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf20, lpOverlapped=0x0) returned 1 [0223.054] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.078] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.089] CloseHandle (hObject=0x10c) returned 1 [0223.089] CloseHandle (hObject=0x104) returned 1 [0223.089] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q403s_jhOF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q403s_jhof.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71343033735F6A684F46.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71343033735f6a684f46.lnk")) returned 0 [0223.090] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71343033735F6A684F46.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71343033735f6a684f46.lnk")) returned 0x20 [0223.090] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q403s_jhOF.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cdab50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xf10, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="q403s_jhOF.lnk", cAlternateFileName="Q403S_~1.LNK")) returned 0x325018 [0223.090] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cdab50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xf10, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="q403s_jhOF.lnk", cAlternateFileName="Q403S_~1.LNK")) returned 0 [0223.090] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0223.090] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q403s_jhOF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q403s_jhof.lnk")) returned 1 [0223.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q403s_jhOF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q403s_jhof.lnk")) returned 0xffffffff [0223.091] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa288a370, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa288a370, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa288a370, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1b3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="qajg5MIpIcbVTzO- L.lnk", cAlternateFileName="QAJG5M~1.LNK")) returned 1 [0223.092] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0223.092] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.092] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0223.092] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0223.092] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b06c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0223.092] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.092] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b06c) returned 0x10ab [0223.092] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0223.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qajg5MIpIcbVTzO- L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qajg5mipicbvtzo- l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0223.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71616A67354D497049636256547A4F2D204C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71616a67354d497049636256547a4f2d204c.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0223.093] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b3d [0223.093] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0223.094] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0223.188] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b3d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1b3d, lpOverlapped=0x0) returned 1 [0223.189] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b40, lpOverlapped=0x0) returned 1 [0223.190] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.212] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.223] CloseHandle (hObject=0x104) returned 1 [0223.223] CloseHandle (hObject=0x10c) returned 1 [0223.223] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qajg5MIpIcbVTzO- L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qajg5mipicbvtzo- l.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71616A67354D497049636256547A4F2D204C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71616a67354d497049636256547a4f2d204c.lnk")) returned 0 [0223.224] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71616A67354D497049636256547A4F2D204C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71616a67354d497049636256547a4f2d204c.lnk")) returned 0x20 [0223.224] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qajg5MIpIcbVTzO- L.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa288a370, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa288a370, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa288a370, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1b3d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qajg5MIpIcbVTzO- L.lnk", cAlternateFileName="QAJG5M~1.LNK")) returned 0x325018 [0223.224] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa288a370, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa288a370, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa288a370, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1b3d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qajg5MIpIcbVTzO- L.lnk", cAlternateFileName="QAJG5M~1.LNK")) returned 0 [0223.224] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0223.224] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qajg5MIpIcbVTzO- L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qajg5mipicbvtzo- l.lnk")) returned 1 [0223.225] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qajg5MIpIcbVTzO- L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qajg5mipicbvtzo- l.lnk")) returned 0xffffffff [0223.225] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="qgZ1uci-rIE2 2_.lnk", cAlternateFileName="QGZ1UC~1.LNK")) returned 1 [0223.226] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0223.226] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.226] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0223.226] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0223.227] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b06c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0223.227] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.227] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b06c) returned 0x10ab [0223.227] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0223.227] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgZ1uci-rIE2 2_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qgz1uci-rie2 2_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0223.227] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71675A317563692D7249453220325F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71675a317563692d7249453220325f.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0223.229] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x261 [0223.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0223.229] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0223.316] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x261, lpOverlapped=0x0) returned 1 [0223.317] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x270, lpOverlapped=0x0) returned 1 [0223.318] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.340] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.351] CloseHandle (hObject=0x10c) returned 1 [0223.351] CloseHandle (hObject=0x104) returned 1 [0223.351] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgZ1uci-rIE2 2_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qgz1uci-rie2 2_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71675A317563692D7249453220325F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71675a317563692d7249453220325f.lnk")) returned 0 [0223.352] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\71675A317563692D7249453220325F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\71675a317563692d7249453220325f.lnk")) returned 0x20 [0223.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgZ1uci-rIE2 2_.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qgZ1uci-rIE2 2_.lnk", cAlternateFileName="QGZ1UC~1.LNK")) returned 0x325018 [0223.352] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qgZ1uci-rIE2 2_.lnk", cAlternateFileName="QGZ1UC~1.LNK")) returned 0 [0223.352] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0223.352] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgZ1uci-rIE2 2_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qgz1uci-rie2 2_.lnk")) returned 1 [0223.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgZ1uci-rIE2 2_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qgz1uci-rie2 2_.lnk")) returned 0xffffffff [0223.353] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e7da70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e7da70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e7da70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="QPlC3MrxDxBoh_nGWn0Q.lnk", cAlternateFileName="QPLC3M~1.LNK")) returned 1 [0223.354] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0223.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0223.354] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0223.354] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0c0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0223.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0c0) returned 0x10ab [0223.355] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0223.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QPlC3MrxDxBoh_nGWn0Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qplc3mrxdxboh_ngwn0q.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0223.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\51506C43334D72784478426F685F6E47576E3051.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\51506c43334d72784478426f685f6e47576e3051.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0223.356] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9e [0223.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0223.356] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0223.438] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa9e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa9e, lpOverlapped=0x0) returned 1 [0223.438] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xaa0, lpOverlapped=0x0) returned 1 [0223.440] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.477] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.488] CloseHandle (hObject=0x104) returned 1 [0223.488] CloseHandle (hObject=0x10c) returned 1 [0223.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QPlC3MrxDxBoh_nGWn0Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qplc3mrxdxboh_ngwn0q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\51506C43334D72784478426F685F6E47576E3051.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\51506c43334d72784478426f685f6e47576e3051.lnk")) returned 0 [0223.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\51506C43334D72784478426F685F6E47576E3051.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\51506c43334d72784478426f685f6e47576e3051.lnk")) returned 0x20 [0223.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QPlC3MrxDxBoh_nGWn0Q.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e7da70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e7da70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e7da70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QPlC3MrxDxBoh_nGWn0Q.lnk", cAlternateFileName="QPLC3M~1.LNK")) returned 0x325018 [0223.489] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e7da70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e7da70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e7da70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QPlC3MrxDxBoh_nGWn0Q.lnk", cAlternateFileName="QPLC3M~1.LNK")) returned 0 [0223.489] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0223.490] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QPlC3MrxDxBoh_nGWn0Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qplc3mrxdxboh_ngwn0q.lnk")) returned 1 [0223.491] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QPlC3MrxDxBoh_nGWn0Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qplc3mrxdxboh_ngwn0q.lnk")) returned 0xffffffff [0223.491] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa277f9d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa277f9d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa277f9d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="qRqPMQQGIqZmhsNVx.lnk", cAlternateFileName="QRQPMQ~1.LNK")) returned 1 [0223.491] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0223.492] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.492] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0223.492] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0223.492] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b024, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0223.492] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.492] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b024) returned 0x10ab [0223.492] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0223.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qRqPMQQGIqZmhsNVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qrqpmqqgiqzmhsnvx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0223.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\715271504D51514749715A6D68734E5678.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\715271504d51514749715a6d68734e5678.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0223.494] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa64 [0223.494] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0223.494] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0223.597] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa64, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa64, lpOverlapped=0x0) returned 1 [0223.598] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa70, lpOverlapped=0x0) returned 1 [0223.599] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.630] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.641] CloseHandle (hObject=0x10c) returned 1 [0223.641] CloseHandle (hObject=0x104) returned 1 [0223.641] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qRqPMQQGIqZmhsNVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qrqpmqqgiqzmhsnvx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\715271504D51514749715A6D68734E5678.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\715271504d51514749715a6d68734e5678.lnk")) returned 0 [0223.642] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\715271504D51514749715A6D68734E5678.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\715271504d51514749715a6d68734e5678.lnk")) returned 0x20 [0223.642] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qRqPMQQGIqZmhsNVx.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa277f9d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa277f9d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa277f9d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qRqPMQQGIqZmhsNVx.lnk", cAlternateFileName="QRQPMQ~1.LNK")) returned 0x325018 [0223.643] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa277f9d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa277f9d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa277f9d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qRqPMQQGIqZmhsNVx.lnk", cAlternateFileName="QRQPMQ~1.LNK")) returned 0 [0223.643] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0223.643] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qRqPMQQGIqZmhsNVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qrqpmqqgiqzmhsnvx.lnk")) returned 1 [0223.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qRqPMQQGIqZmhsNVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qrqpmqqgiqzmhsnvx.lnk")) returned 0xffffffff [0223.644] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29228f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29228f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29228f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="QSj0.lnk", cAlternateFileName="")) returned 1 [0223.645] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0223.645] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.645] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0223.645] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0223.645] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0223.645] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.645] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0223.645] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0223.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSj0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qsj0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0223.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\51536A30.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\51536a30.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0223.646] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f1 [0223.646] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0223.647] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0223.719] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9f1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9f1, lpOverlapped=0x0) returned 1 [0223.720] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0223.721] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.745] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.756] CloseHandle (hObject=0x104) returned 1 [0223.756] CloseHandle (hObject=0x10c) returned 1 [0223.772] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSj0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qsj0.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\51536A30.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\51536a30.lnk")) returned 0 [0223.773] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\51536A30.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\51536a30.lnk")) returned 0x20 [0223.773] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSj0.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29228f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29228f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29228f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QSj0.lnk", cAlternateFileName="")) returned 0x325018 [0223.773] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29228f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29228f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29228f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QSj0.lnk", cAlternateFileName="")) returned 0 [0223.773] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0223.773] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSj0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qsj0.lnk")) returned 1 [0223.774] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSj0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qsj0.lnk")) returned 0xffffffff [0223.774] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa245fcf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa245fcf0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa245fcf0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="qVSwND72LMnoyfNm8fe.mkv.lnk", cAlternateFileName="QVSWND~1.LNK")) returned 1 [0223.775] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0223.775] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.775] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0223.775] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0223.775] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0223.775] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.776] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0223.776] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0223.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVSwND72LMnoyfNm8fe.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvswnd72lmnoyfnm8fe.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0223.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\715653774E4437324C4D6E6F79664E6D3866652E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\715653774e4437324c4d6e6f79664e6d3866652e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0223.777] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea1 [0223.777] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0223.777] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0223.850] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xea1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xea1, lpOverlapped=0x0) returned 1 [0223.850] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xeb0, lpOverlapped=0x0) returned 1 [0223.851] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.874] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.885] CloseHandle (hObject=0x10c) returned 1 [0223.885] CloseHandle (hObject=0x104) returned 1 [0223.885] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVSwND72LMnoyfNm8fe.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvswnd72lmnoyfnm8fe.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\715653774E4437324C4D6E6F79664E6D3866652E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\715653774e4437324c4d6e6f79664e6d3866652e6d6b76.lnk")) returned 0 [0223.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\715653774E4437324C4D6E6F79664E6D3866652E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\715653774e4437324c4d6e6f79664e6d3866652e6d6b76.lnk")) returned 0x20 [0223.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVSwND72LMnoyfNm8fe.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa245fcf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa245fcf0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa245fcf0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qVSwND72LMnoyfNm8fe.mkv.lnk", cAlternateFileName="QVSWND~1.LNK")) returned 0x325018 [0223.886] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa245fcf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa245fcf0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa245fcf0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qVSwND72LMnoyfNm8fe.mkv.lnk", cAlternateFileName="QVSWND~1.LNK")) returned 0 [0223.886] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0223.886] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVSwND72LMnoyfNm8fe.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvswnd72lmnoyfnm8fe.mkv.lnk")) returned 1 [0223.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVSwND72LMnoyfNm8fe.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvswnd72lmnoyfnm8fe.mkv.lnk")) returned 0xffffffff [0223.887] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a2d290, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a2d290, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a2d290, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Qw7E4hhQ.lnk", cAlternateFileName="")) returned 1 [0223.888] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0223.888] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.888] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0223.888] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0223.888] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0223.888] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0223.888] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0223.888] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0223.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qw7E4hhQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qw7e4hhq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0223.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5177374534686851.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5177374534686851.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0223.890] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e8 [0223.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0223.890] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0223.984] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3e8, lpOverlapped=0x0) returned 1 [0223.985] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0223.985] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.008] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.019] CloseHandle (hObject=0x104) returned 1 [0224.019] CloseHandle (hObject=0x10c) returned 1 [0224.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qw7E4hhQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qw7e4hhq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5177374534686851.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5177374534686851.lnk")) returned 0 [0224.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5177374534686851.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5177374534686851.lnk")) returned 0x20 [0224.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qw7E4hhQ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a2d290, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a2d290, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a2d290, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Qw7E4hhQ.lnk", cAlternateFileName="")) returned 0x325018 [0224.020] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a2d290, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a2d290, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a2d290, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Qw7E4hhQ.lnk", cAlternateFileName="")) returned 0 [0224.020] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0224.021] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qw7E4hhQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qw7e4hhq.lnk")) returned 1 [0224.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qw7E4hhQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qw7e4hhq.lnk")) returned 0xffffffff [0224.022] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e92750, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1e92750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1e92750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="R2UvMVl1DFxVWCVOUXjE.lnk", cAlternateFileName="R2UVMV~1.LNK")) returned 1 [0224.023] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0224.023] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.023] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0224.023] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0224.023] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0224.023] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.023] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0224.023] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0224.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2UvMVl1DFxVWCVOUXjE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2uvmvl1dfxvwcvouxje.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0224.024] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\523255764D566C31444678565743564F55586A45.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\523255764d566c31444678565743564f55586a45.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0224.025] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa5 [0224.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0224.025] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0224.114] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xaa5, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xaa5, lpOverlapped=0x0) returned 1 [0224.114] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xab0, lpOverlapped=0x0) returned 1 [0224.115] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.138] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.149] CloseHandle (hObject=0x10c) returned 1 [0224.149] CloseHandle (hObject=0x104) returned 1 [0224.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2UvMVl1DFxVWCVOUXjE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2uvmvl1dfxvwcvouxje.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\523255764D566C31444678565743564F55586A45.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\523255764d566c31444678565743564f55586a45.lnk")) returned 0 [0224.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\523255764D566C31444678565743564F55586A45.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\523255764d566c31444678565743564f55586a45.lnk")) returned 0x20 [0224.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2UvMVl1DFxVWCVOUXjE.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e92750, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1e92750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1e92750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="R2UvMVl1DFxVWCVOUXjE.lnk", cAlternateFileName="R2UVMV~1.LNK")) returned 0x325018 [0224.150] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e92750, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1e92750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1e92750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="R2UvMVl1DFxVWCVOUXjE.lnk", cAlternateFileName="R2UVMV~1.LNK")) returned 0 [0224.150] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0224.150] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2UvMVl1DFxVWCVOUXjE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2uvmvl1dfxvwcvouxje.lnk")) returned 1 [0224.151] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2UvMVl1DFxVWCVOUXjE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2uvmvl1dfxvwcvouxje.lnk")) returned 0xffffffff [0224.151] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1239530, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e57910, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e57910, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0224.152] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0224.152] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0224.152] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0224.152] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0224.152] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0224.152] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0224.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0224.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\526F616D696E67.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\526f616d696e67.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0224.154] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x303 [0224.154] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0224.154] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0224.227] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x303, lpOverlapped=0x0) returned 1 [0224.228] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x310, lpOverlapped=0x0) returned 1 [0224.229] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.251] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.266] CloseHandle (hObject=0x104) returned 1 [0224.267] CloseHandle (hObject=0x10c) returned 1 [0224.267] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\526F616D696E67.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\526f616d696e67.lnk")) returned 0 [0224.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\526F616D696E67.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\526f616d696e67.lnk")) returned 0x20 [0224.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1239530, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e57910, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e57910, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Roaming.lnk", cAlternateFileName="")) returned 0x325018 [0224.269] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1239530, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2e57910, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2e57910, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Roaming.lnk", cAlternateFileName="")) returned 0 [0224.269] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0224.269] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 1 [0224.271] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 0xffffffff [0224.271] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAaiffj.lnk", cAlternateFileName="")) returned 1 [0224.272] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0224.272] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.272] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0224.272] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0224.273] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0224.273] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.273] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0224.273] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0224.273] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sAaiffj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\saaiffj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0224.273] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7341616966666A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7341616966666a.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0224.275] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa16 [0224.275] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0224.275] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0224.363] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa16, lpOverlapped=0x0) returned 1 [0224.364] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0224.365] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.416] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.426] CloseHandle (hObject=0x10c) returned 1 [0224.426] CloseHandle (hObject=0x104) returned 1 [0224.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sAaiffj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\saaiffj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7341616966666A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7341616966666a.lnk")) returned 0 [0224.427] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7341616966666A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7341616966666a.lnk")) returned 0x20 [0224.428] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sAaiffj.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sAaiffj.lnk", cAlternateFileName="")) returned 0x325018 [0224.428] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa256a690, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa256a690, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa256a690, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sAaiffj.lnk", cAlternateFileName="")) returned 0 [0224.428] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0224.428] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sAaiffj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\saaiffj.lnk")) returned 1 [0224.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sAaiffj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\saaiffj.lnk")) returned 0xffffffff [0224.429] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e92750, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCzp1EW HinPZZsgc.lnk", cAlternateFileName="SCZP1E~1.LNK")) returned 1 [0224.430] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0224.430] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.430] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0224.430] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0224.430] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0224.430] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.430] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0224.430] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0224.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCzp1EW HinPZZsgc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sczp1ew hinpzzsgc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0224.431] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\53437A703145572048696E505A5A736763.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\53437a703145572048696e505a5a736763.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0224.432] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cf [0224.432] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0224.432] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0224.518] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x12cf, lpOverlapped=0x0) returned 1 [0224.519] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x12d0, lpOverlapped=0x0) returned 1 [0224.520] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.544] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.555] CloseHandle (hObject=0x104) returned 1 [0224.555] CloseHandle (hObject=0x10c) returned 1 [0224.555] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCzp1EW HinPZZsgc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sczp1ew hinpzzsgc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\53437A703145572048696E505A5A736763.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\53437a703145572048696e505a5a736763.lnk")) returned 0 [0224.556] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\53437A703145572048696E505A5A736763.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\53437a703145572048696e505a5a736763.lnk")) returned 0x20 [0224.556] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCzp1EW HinPZZsgc.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e92750, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="SCzp1EW HinPZZsgc.lnk", cAlternateFileName="SCZP1E~1.LNK")) returned 0x325018 [0224.556] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e92750, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ea3bd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ea3bd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="SCzp1EW HinPZZsgc.lnk", cAlternateFileName="SCZP1E~1.LNK")) returned 0 [0224.556] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0224.556] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCzp1EW HinPZZsgc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sczp1ew hinpzzsgc.lnk")) returned 1 [0224.557] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCzp1EW HinPZZsgc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sczp1ew hinpzzsgc.lnk")) returned 0xffffffff [0224.557] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2de54f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2129, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="sNHhIvTa5j1Q.lnk", cAlternateFileName="SNHHIV~1.LNK")) returned 1 [0224.558] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0224.558] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.558] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0224.558] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0224.558] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0224.558] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.558] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0224.558] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0224.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sNHhIvTa5j1Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snhhivta5j1q.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0224.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\734E486849765461356A3151.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\734e486849765461356a3151.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0224.560] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2129 [0224.560] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0224.560] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0224.661] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2129, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2129, lpOverlapped=0x0) returned 1 [0224.662] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2130, lpOverlapped=0x0) returned 1 [0224.664] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.686] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.697] CloseHandle (hObject=0x10c) returned 1 [0224.697] CloseHandle (hObject=0x104) returned 1 [0224.697] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sNHhIvTa5j1Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snhhivta5j1q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\734E486849765461356A3151.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\734e486849765461356a3151.lnk")) returned 0 [0224.698] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\734E486849765461356A3151.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\734e486849765461356a3151.lnk")) returned 0x20 [0224.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sNHhIvTa5j1Q.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2de54f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2129, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sNHhIvTa5j1Q.lnk", cAlternateFileName="SNHHIV~1.LNK")) returned 0x325018 [0224.698] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2de54f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2de54f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2de54f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2129, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sNHhIvTa5j1Q.lnk", cAlternateFileName="SNHHIV~1.LNK")) returned 0 [0224.699] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0224.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sNHhIvTa5j1Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snhhivta5j1q.lnk")) returned 1 [0224.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sNHhIvTa5j1Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snhhivta5j1q.lnk")) returned 0xffffffff [0224.700] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27cbc90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa27cbc90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa27cbc90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sOnfvh4Peetii9eZ049.lnk", cAlternateFileName="SONFVH~1.LNK")) returned 1 [0224.700] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0224.700] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.700] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0224.700] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0224.701] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0224.701] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.701] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0224.701] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0224.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOnfvh4Peetii9eZ049.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sonfvh4peetii9ez049.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0224.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\734F6E6676683450656574696939655A303439.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\734f6e6676683450656574696939655a303439.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0224.702] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7a [0224.702] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0224.703] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0224.800] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa7a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa7a, lpOverlapped=0x0) returned 1 [0224.802] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa80, lpOverlapped=0x0) returned 1 [0224.804] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.831] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.843] CloseHandle (hObject=0x104) returned 1 [0224.843] CloseHandle (hObject=0x10c) returned 1 [0224.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOnfvh4Peetii9eZ049.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sonfvh4peetii9ez049.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\734F6E6676683450656574696939655A303439.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\734f6e6676683450656574696939655a303439.lnk")) returned 0 [0224.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\734F6E6676683450656574696939655A303439.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\734f6e6676683450656574696939655a303439.lnk")) returned 0x20 [0224.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOnfvh4Peetii9eZ049.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27cbc90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa27cbc90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa27cbc90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sOnfvh4Peetii9eZ049.lnk", cAlternateFileName="SONFVH~1.LNK")) returned 0x325018 [0224.845] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27cbc90, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa27cbc90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa27cbc90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sOnfvh4Peetii9eZ049.lnk", cAlternateFileName="SONFVH~1.LNK")) returned 0 [0224.845] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0224.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOnfvh4Peetii9eZ049.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sonfvh4peetii9ez049.lnk")) returned 1 [0224.847] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOnfvh4Peetii9eZ049.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sonfvh4peetii9ez049.lnk")) returned 0xffffffff [0224.847] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc790, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28fc790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28fc790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1354, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="SsjN534mj0TYrPelGl.flv.lnk", cAlternateFileName="SSJN53~1.LNK")) returned 1 [0224.848] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0224.848] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.848] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0224.848] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0224.848] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0224.848] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.848] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0224.848] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0224.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SsjN534mj0TYrPelGl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ssjn534mj0tyrpelgl.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0224.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\53736A4E3533346D6A3054597250656C476C2E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\53736a4e3533346d6a3054597250656c476c2e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0224.851] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1354 [0224.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0224.851] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0224.926] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1354, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1354, lpOverlapped=0x0) returned 1 [0224.927] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1360, lpOverlapped=0x0) returned 1 [0224.928] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.951] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.962] CloseHandle (hObject=0x10c) returned 1 [0224.962] CloseHandle (hObject=0x104) returned 1 [0224.962] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SsjN534mj0TYrPelGl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ssjn534mj0tyrpelgl.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\53736A4E3533346D6A3054597250656C476C2E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\53736a4e3533346d6a3054597250656c476c2e666c76.lnk")) returned 0 [0224.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\53736A4E3533346D6A3054597250656C476C2E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\53736a4e3533346d6a3054597250656c476c2e666c76.lnk")) returned 0x20 [0224.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SsjN534mj0TYrPelGl.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc790, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28fc790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28fc790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1354, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="SsjN534mj0TYrPelGl.flv.lnk", cAlternateFileName="SSJN53~1.LNK")) returned 0x325018 [0224.963] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc790, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28fc790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28fc790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1354, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="SsjN534mj0TYrPelGl.flv.lnk", cAlternateFileName="SSJN53~1.LNK")) returned 0 [0224.963] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0224.963] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SsjN534mj0TYrPelGl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ssjn534mj0tyrpelgl.flv.lnk")) returned 1 [0224.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SsjN534mj0TYrPelGl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ssjn534mj0tyrpelgl.flv.lnk")) returned 0xffffffff [0224.964] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bf6310, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bf6310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeca, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="t2b_.lnk", cAlternateFileName="")) returned 1 [0224.965] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0224.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0224.965] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0224.965] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0224.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0224.966] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0224.966] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0224.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t2b_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t2b_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0224.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7432625F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7432625f.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0224.967] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeca [0224.967] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0224.967] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0225.056] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xeca, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xeca, lpOverlapped=0x0) returned 1 [0225.056] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xed0, lpOverlapped=0x0) returned 1 [0225.057] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.080] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.091] CloseHandle (hObject=0x104) returned 1 [0225.091] CloseHandle (hObject=0x10c) returned 1 [0225.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t2b_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t2b_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7432625F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7432625f.lnk")) returned 0 [0225.092] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7432625F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7432625f.lnk")) returned 0x20 [0225.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t2b_.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bf6310, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bf6310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeca, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="t2b_.lnk", cAlternateFileName="")) returned 0x325018 [0225.092] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bf6310, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bf6310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xeca, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="t2b_.lnk", cAlternateFileName="")) returned 0 [0225.092] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0225.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t2b_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t2b_.lnk")) returned 1 [0225.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t2b_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t2b_.lnk")) returned 0xffffffff [0225.093] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24abfb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24abfb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24d2110, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="taE1q8sNqoI.lnk", cAlternateFileName="TAE1Q8~1.LNK")) returned 1 [0225.094] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0225.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0225.094] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0225.094] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0225.095] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.095] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0225.095] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0225.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\taE1q8sNqoI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tae1q8snqoi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0225.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\746145317138734E716F49.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\746145317138734e716f49.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0225.096] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa22 [0225.096] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0225.096] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0225.212] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa22, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa22, lpOverlapped=0x0) returned 1 [0225.213] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa30, lpOverlapped=0x0) returned 1 [0225.214] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.237] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.248] CloseHandle (hObject=0x10c) returned 1 [0225.248] CloseHandle (hObject=0x104) returned 1 [0225.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\taE1q8sNqoI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tae1q8snqoi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\746145317138734E716F49.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\746145317138734e716f49.lnk")) returned 0 [0225.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\746145317138734E716F49.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\746145317138734e716f49.lnk")) returned 0x20 [0225.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\taE1q8sNqoI.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24abfb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24abfb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24d2110, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="taE1q8sNqoI.lnk", cAlternateFileName="TAE1Q8~1.LNK")) returned 0x325018 [0225.249] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24abfb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24abfb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24d2110, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="taE1q8sNqoI.lnk", cAlternateFileName="TAE1Q8~1.LNK")) returned 0 [0225.249] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0225.250] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\taE1q8sNqoI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tae1q8snqoi.lnk")) returned 1 [0225.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\taE1q8sNqoI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tae1q8snqoi.lnk")) returned 0xffffffff [0225.251] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24abfb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24abfb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24abfb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="tV3gU850Nx.lnk", cAlternateFileName="TV3GU8~1.LNK")) returned 1 [0225.251] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0225.251] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.252] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0225.252] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0225.252] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0225.252] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.252] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0225.252] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0225.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tV3gU850Nx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tv3gu850nx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0225.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\74563367553835304E78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\74563367553835304e78.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0225.254] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1b [0225.254] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0225.254] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0225.334] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa1b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa1b, lpOverlapped=0x0) returned 1 [0225.335] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0225.336] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.358] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.369] CloseHandle (hObject=0x104) returned 1 [0225.369] CloseHandle (hObject=0x10c) returned 1 [0225.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tV3gU850Nx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tv3gu850nx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\74563367553835304E78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\74563367553835304e78.lnk")) returned 0 [0225.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\74563367553835304E78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\74563367553835304e78.lnk")) returned 0x20 [0225.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tV3gU850Nx.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24abfb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24abfb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24abfb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="tV3gU850Nx.lnk", cAlternateFileName="TV3GU8~1.LNK")) returned 0x325018 [0225.370] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24abfb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa24abfb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa24abfb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="tV3gU850Nx.lnk", cAlternateFileName="TV3GU8~1.LNK")) returned 0 [0225.370] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0225.370] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tV3gU850Nx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tv3gu850nx.lnk")) returned 1 [0225.371] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tV3gU850Nx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tv3gu850nx.lnk")) returned 0xffffffff [0225.371] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29bae70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29bae70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29bae70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TyBijOqkZdepz7On6MwK.mkv.lnk", cAlternateFileName="TYBIJO~1.LNK")) returned 1 [0225.372] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0225.372] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.372] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0225.372] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0225.373] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0225.373] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.373] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0225.373] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0225.373] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TyBijOqkZdepz7On6MwK.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tybijoqkzdepz7on6mwk.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0225.373] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\547942696A4F716B5A6465707A374F6E364D774B2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\547942696a4f716b5a6465707a374f6e364d774b2e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0225.374] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0f [0225.374] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0225.375] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0225.484] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f0f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1f0f, lpOverlapped=0x0) returned 1 [0225.485] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1f10, lpOverlapped=0x0) returned 1 [0225.486] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.508] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.519] CloseHandle (hObject=0x10c) returned 1 [0225.519] CloseHandle (hObject=0x104) returned 1 [0225.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TyBijOqkZdepz7On6MwK.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tybijoqkzdepz7on6mwk.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\547942696A4F716B5A6465707A374F6E364D774B2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\547942696a4f716b5a6465707a374f6e364d774b2e6d6b76.lnk")) returned 0 [0225.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\547942696A4F716B5A6465707A374F6E364D774B2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\547942696a4f716b5a6465707a374f6e364d774b2e6d6b76.lnk")) returned 0x20 [0225.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TyBijOqkZdepz7On6MwK.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29bae70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29bae70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29bae70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="TyBijOqkZdepz7On6MwK.mkv.lnk", cAlternateFileName="TYBIJO~1.LNK")) returned 0x325018 [0225.520] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29bae70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa29bae70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa29bae70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="TyBijOqkZdepz7On6MwK.mkv.lnk", cAlternateFileName="TYBIJO~1.LNK")) returned 0 [0225.520] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0225.520] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TyBijOqkZdepz7On6MwK.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tybijoqkzdepz7on6mwk.mkv.lnk")) returned 1 [0225.521] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TyBijOqkZdepz7On6MwK.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tybijoqkzdepz7on6mwk.mkv.lnk")) returned 0xffffffff [0225.521] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2119eb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2119eb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2119eb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="uaUXHwQq.lnk", cAlternateFileName="")) returned 1 [0225.522] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0225.522] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.522] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0225.522] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0225.523] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0225.523] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.523] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0c4) returned 0x10ab [0225.523] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0225.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uaUXHwQq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uauxhwqq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0225.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7561555848775171.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7561555848775171.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0225.524] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1a [0225.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0225.525] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0225.611] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa1a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa1a, lpOverlapped=0x0) returned 1 [0225.612] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0225.613] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.662] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.672] CloseHandle (hObject=0x104) returned 1 [0225.672] CloseHandle (hObject=0x10c) returned 1 [0225.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uaUXHwQq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uauxhwqq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7561555848775171.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7561555848775171.lnk")) returned 0 [0225.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7561555848775171.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7561555848775171.lnk")) returned 0x20 [0225.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uaUXHwQq.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2119eb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2119eb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2119eb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uaUXHwQq.lnk", cAlternateFileName="")) returned 0x325018 [0225.674] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2119eb0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2119eb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2119eb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uaUXHwQq.lnk", cAlternateFileName="")) returned 0 [0225.674] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0225.674] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uaUXHwQq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uauxhwqq.lnk")) returned 1 [0225.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uaUXHwQq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uauxhwqq.lnk")) returned 0xffffffff [0225.675] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa11c7110, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f622b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f622b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="UN6XF0CnxZ.lnk", cAlternateFileName="UN6XF0~1.LNK")) returned 1 [0225.676] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0225.676] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.676] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0225.676] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0225.676] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0225.676] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.676] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0225.676] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0225.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UN6XF0CnxZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\un6xf0cnxz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0225.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\554E36584630436E785A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\554e36584630436e785a.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0225.679] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0225.680] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0225.680] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0225.760] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x269, lpOverlapped=0x0) returned 1 [0225.761] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x270, lpOverlapped=0x0) returned 1 [0225.762] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.787] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.798] CloseHandle (hObject=0x10c) returned 1 [0225.798] CloseHandle (hObject=0x104) returned 1 [0225.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UN6XF0CnxZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\un6xf0cnxz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\554E36584630436E785A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\554e36584630436e785a.lnk")) returned 0 [0225.799] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\554E36584630436E785A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\554e36584630436e785a.lnk")) returned 0x20 [0225.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UN6XF0CnxZ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa11c7110, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f622b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f622b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="UN6XF0CnxZ.lnk", cAlternateFileName="UN6XF0~1.LNK")) returned 0x325018 [0225.799] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa11c7110, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f622b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f622b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="UN6XF0CnxZ.lnk", cAlternateFileName="UN6XF0~1.LNK")) returned 0 [0225.799] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0225.799] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UN6XF0CnxZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\un6xf0cnxz.lnk")) returned 1 [0225.800] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UN6XF0CnxZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\un6xf0cnxz.lnk")) returned 0xffffffff [0225.800] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2759870, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2759870, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2759870, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x14d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="uPRSRoe8zG3ShJ-MO.lnk", cAlternateFileName="UPRSRO~1.LNK")) returned 1 [0225.801] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0225.801] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.801] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0225.801] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0225.801] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b058, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0225.801] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.801] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b058) returned 0x10ab [0225.801] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0225.802] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPRSRoe8zG3ShJ-MO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uprsroe8zg3shj-mo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0225.802] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\75505253526F65387A473353684A2D4D4F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\75505253526f65387a473353684a2d4d4f.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0225.803] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d8 [0225.803] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0225.804] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0225.902] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14d8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x14d8, lpOverlapped=0x0) returned 1 [0225.903] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x14e0, lpOverlapped=0x0) returned 1 [0225.904] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.929] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.939] CloseHandle (hObject=0x104) returned 1 [0225.939] CloseHandle (hObject=0x10c) returned 1 [0225.940] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPRSRoe8zG3ShJ-MO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uprsroe8zg3shj-mo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\75505253526F65387A473353684A2D4D4F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\75505253526f65387a473353684a2d4d4f.lnk")) returned 0 [0225.941] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\75505253526F65387A473353684A2D4D4F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\75505253526f65387a473353684a2d4d4f.lnk")) returned 0x20 [0225.941] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPRSRoe8zG3ShJ-MO.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2759870, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2759870, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2759870, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x14d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uPRSRoe8zG3ShJ-MO.lnk", cAlternateFileName="UPRSRO~1.LNK")) returned 0x325018 [0225.941] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2759870, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2759870, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2759870, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x14d8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uPRSRoe8zG3ShJ-MO.lnk", cAlternateFileName="UPRSRO~1.LNK")) returned 0 [0225.941] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0225.941] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPRSRoe8zG3ShJ-MO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uprsroe8zg3shj-mo.lnk")) returned 1 [0225.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPRSRoe8zG3ShJ-MO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uprsroe8zg3shj-mo.lnk")) returned 0xffffffff [0225.942] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bf6310, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bf6310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="uPWQ9hVwHw8DGqMGBJsu.lnk", cAlternateFileName="UPWQ9H~1.LNK")) returned 1 [0225.943] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0225.943] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.943] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0225.943] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0225.943] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0225.943] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0225.943] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b8) returned 0x10ab [0225.943] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0225.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPWQ9hVwHw8DGqMGBJsu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upwq9hvwhw8dgqmgbjsu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0225.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\75505751396856774877384447714D47424A7375.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\75505751396856774877384447714d47424a7375.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0225.945] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x306 [0225.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0225.945] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0226.033] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x306, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x306, lpOverlapped=0x0) returned 1 [0226.034] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x310, lpOverlapped=0x0) returned 1 [0226.035] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.058] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.069] CloseHandle (hObject=0x10c) returned 1 [0226.069] CloseHandle (hObject=0x104) returned 1 [0226.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPWQ9hVwHw8DGqMGBJsu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upwq9hvwhw8dgqmgbjsu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\75505751396856774877384447714D47424A7375.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\75505751396856774877384447714d47424a7375.lnk")) returned 0 [0226.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\75505751396856774877384447714D47424A7375.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\75505751396856774877384447714d47424a7375.lnk")) returned 0x20 [0226.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPWQ9hVwHw8DGqMGBJsu.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bf6310, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bf6310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uPWQ9hVwHw8DGqMGBJsu.lnk", cAlternateFileName="UPWQ9H~1.LNK")) returned 0x325018 [0226.070] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bf6310, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bf6310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uPWQ9hVwHw8DGqMGBJsu.lnk", cAlternateFileName="UPWQ9H~1.LNK")) returned 0 [0226.070] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0226.070] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPWQ9hVwHw8DGqMGBJsu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upwq9hvwhw8dgqmgbjsu.lnk")) returned 1 [0226.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uPWQ9hVwHw8DGqMGBJsu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upwq9hvwhw8dgqmgbjsu.lnk")) returned 0xffffffff [0226.071] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b83ef0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1428, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="us hqSazwMHtMKPW 8.lnk", cAlternateFileName="USHQSA~1.LNK")) returned 1 [0226.072] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0226.072] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.072] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0226.072] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0226.072] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0226.072] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.072] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0226.072] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0226.072] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\us hqSazwMHtMKPW 8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\us hqsazwmhtmkpw 8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0226.072] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\757320687153617A774D48744D4B50572038.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\757320687153617a774d48744d4b50572038.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0226.073] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1428 [0226.074] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0226.074] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0226.148] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1428, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1428, lpOverlapped=0x0) returned 1 [0226.149] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1430, lpOverlapped=0x0) returned 1 [0226.150] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.184] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.199] CloseHandle (hObject=0x104) returned 1 [0226.199] CloseHandle (hObject=0x10c) returned 1 [0226.201] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\us hqSazwMHtMKPW 8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\us hqsazwmhtmkpw 8.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\757320687153617A774D48744D4B50572038.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\757320687153617a774d48744d4b50572038.lnk")) returned 0 [0226.203] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\757320687153617A774D48744D4B50572038.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\757320687153617a774d48744d4b50572038.lnk")) returned 0x20 [0226.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\us hqSazwMHtMKPW 8.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b83ef0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1428, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="us hqSazwMHtMKPW 8.lnk", cAlternateFileName="USHQSA~1.LNK")) returned 0x325018 [0226.203] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b83ef0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1428, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="us hqSazwMHtMKPW 8.lnk", cAlternateFileName="USHQSA~1.LNK")) returned 0 [0226.203] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0226.203] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\us hqSazwMHtMKPW 8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\us hqsazwmhtmkpw 8.lnk")) returned 1 [0226.204] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\us hqSazwMHtMKPW 8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\us hqsazwmhtmkpw 8.lnk")) returned 0xffffffff [0226.204] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f3c150, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="uX4bMIs.lnk", cAlternateFileName="")) returned 1 [0226.207] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0226.207] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0226.211] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0226.211] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0226.211] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0226.211] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0226.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uX4bMIs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ux4bmis.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0226.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\755834624D4973.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\755834624d4973.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0226.213] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f6 [0226.213] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0226.213] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0226.304] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9f6, lpOverlapped=0x0) returned 1 [0226.304] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0226.305] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.328] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.339] CloseHandle (hObject=0x10c) returned 1 [0226.339] CloseHandle (hObject=0x104) returned 1 [0226.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uX4bMIs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ux4bmis.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\755834624D4973.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\755834624d4973.lnk")) returned 0 [0226.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\755834624D4973.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\755834624d4973.lnk")) returned 0x20 [0226.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uX4bMIs.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f3c150, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uX4bMIs.lnk", cAlternateFileName="")) returned 0x325018 [0226.341] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f3c150, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uX4bMIs.lnk", cAlternateFileName="")) returned 0 [0226.341] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0226.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uX4bMIs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ux4bmis.lnk")) returned 1 [0226.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uX4bMIs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ux4bmis.lnk")) returned 0xffffffff [0226.342] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bd01b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bd01b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x0, dwReserved1=0x0, cFileName="uyUyCYMsblyOcw.lnk", cAlternateFileName="UYUYCY~1.LNK")) returned 1 [0226.342] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0226.343] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.343] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0226.343] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0226.343] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b060, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0226.343] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.343] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b060) returned 0x10ab [0226.343] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0226.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uyUyCYMsblyOcw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uyuycymsblyocw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0226.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7579557943594D73626C794F6377.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7579557943594d73626c794f6377.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0226.345] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa47 [0226.345] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0226.345] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0226.482] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa47, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa47, lpOverlapped=0x0) returned 1 [0226.483] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa50, lpOverlapped=0x0) returned 1 [0226.484] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.515] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.526] CloseHandle (hObject=0x104) returned 1 [0226.526] CloseHandle (hObject=0x10c) returned 1 [0226.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uyUyCYMsblyOcw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uyuycymsblyocw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7579557943594D73626C794F6377.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7579557943594d73626c794f6377.lnk")) returned 0 [0226.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7579557943594D73626C794F6377.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7579557943594d73626c794f6377.lnk")) returned 0x20 [0226.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uyUyCYMsblyOcw.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bd01b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bd01b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uyUyCYMsblyOcw.lnk", cAlternateFileName="UYUYCY~1.LNK")) returned 0x325018 [0226.527] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bd01b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2bd01b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2bf6310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uyUyCYMsblyOcw.lnk", cAlternateFileName="UYUYCY~1.LNK")) returned 0 [0226.527] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0226.527] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uyUyCYMsblyOcw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uyuycymsblyocw.lnk")) returned 1 [0226.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uyUyCYMsblyOcw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uyuycymsblyocw.lnk")) returned 0xffffffff [0226.528] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25b6950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25b6950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25b6950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="VgnXuf9D1z1wDHz0Dfz1.lnk", cAlternateFileName="VGNXUF~1.LNK")) returned 1 [0226.529] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0226.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.529] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0226.529] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0226.529] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0226.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b8) returned 0x10ab [0226.530] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0226.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VgnXuf9D1z1wDHz0Dfz1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vgnxuf9d1z1wdhz0dfz1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0226.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\56676E5875663944317A317744487A3044667A31.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\56676e5875663944317a317744487a3044667a31.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0226.531] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ac [0226.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0226.531] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0226.620] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3ac, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3ac, lpOverlapped=0x0) returned 1 [0226.620] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3b0, lpOverlapped=0x0) returned 1 [0226.621] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.644] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.654] CloseHandle (hObject=0x10c) returned 1 [0226.654] CloseHandle (hObject=0x104) returned 1 [0226.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VgnXuf9D1z1wDHz0Dfz1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vgnxuf9d1z1wdhz0dfz1.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\56676E5875663944317A317744487A3044667A31.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\56676e5875663944317a317744487a3044667a31.lnk")) returned 0 [0226.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\56676E5875663944317A317744487A3044667A31.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\56676e5875663944317a317744487a3044667a31.lnk")) returned 0x20 [0226.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VgnXuf9D1z1wDHz0Dfz1.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25b6950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25b6950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25b6950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3ac, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="VgnXuf9D1z1wDHz0Dfz1.lnk", cAlternateFileName="VGNXUF~1.LNK")) returned 0x325018 [0226.656] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25b6950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25b6950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25b6950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3ac, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="VgnXuf9D1z1wDHz0Dfz1.lnk", cAlternateFileName="VGNXUF~1.LNK")) returned 0 [0226.656] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0226.656] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VgnXuf9D1z1wDHz0Dfz1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vgnxuf9d1z1wdhz0dfz1.lnk")) returned 1 [0226.657] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VgnXuf9D1z1wDHz0Dfz1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vgnxuf9d1z1wdhz0dfz1.lnk")) returned 0xffffffff [0226.657] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2baa050, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2baa050, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2baa050, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="vKZTT4.lnk", cAlternateFileName="")) returned 1 [0226.657] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0226.657] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.657] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0226.657] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0226.658] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0226.658] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.658] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0226.658] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0226.658] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vKZTT4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vkztt4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0226.658] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\764B5A545434.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\764b5a545434.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0226.659] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3dc [0226.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0226.660] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0226.736] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3dc, lpOverlapped=0x0) returned 1 [0226.737] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3e0, lpOverlapped=0x0) returned 1 [0226.739] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.761] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.772] CloseHandle (hObject=0x104) returned 1 [0226.772] CloseHandle (hObject=0x10c) returned 1 [0226.772] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vKZTT4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vkztt4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\764B5A545434.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\764b5a545434.lnk")) returned 0 [0226.773] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\764B5A545434.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\764b5a545434.lnk")) returned 0x20 [0226.774] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vKZTT4.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2baa050, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2baa050, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2baa050, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="vKZTT4.lnk", cAlternateFileName="")) returned 0x325018 [0226.774] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2baa050, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2baa050, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2baa050, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="vKZTT4.lnk", cAlternateFileName="")) returned 0 [0226.774] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0226.774] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vKZTT4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vkztt4.lnk")) returned 1 [0226.775] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vKZTT4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vkztt4.lnk")) returned 0xffffffff [0226.775] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25907f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25907f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25907f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="W wJ.mkv.lnk", cAlternateFileName="WWJMKV~1.LNK")) returned 1 [0226.775] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0226.775] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.775] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0226.775] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0226.776] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b020, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0226.776] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.776] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b020) returned 0x10ab [0226.776] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0226.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W wJ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w wj.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0226.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5720774A2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5720774a2e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0226.777] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d0 [0226.777] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0226.778] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0226.868] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3d0, lpOverlapped=0x0) returned 1 [0226.869] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3e0, lpOverlapped=0x0) returned 1 [0226.870] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.892] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.903] CloseHandle (hObject=0x10c) returned 1 [0226.903] CloseHandle (hObject=0x104) returned 1 [0226.903] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W wJ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w wj.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5720774A2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5720774a2e6d6b76.lnk")) returned 0 [0226.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5720774A2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5720774a2e6d6b76.lnk")) returned 0x20 [0226.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W wJ.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25907f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25907f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25907f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="W wJ.mkv.lnk", cAlternateFileName="WWJMKV~1.LNK")) returned 0x325018 [0226.904] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25907f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25907f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25907f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="W wJ.mkv.lnk", cAlternateFileName="WWJMKV~1.LNK")) returned 0 [0226.904] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0226.905] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W wJ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w wj.mkv.lnk")) returned 1 [0226.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W wJ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w wj.mkv.lnk")) returned 0xffffffff [0226.905] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1eb88b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1eb88b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1eb88b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x25d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeLDi9-R18mefBa2Uluz.mkv.lnk", cAlternateFileName="WELDI9~1.LNK")) returned 1 [0226.906] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0226.906] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.906] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0226.906] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0226.907] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0226.907] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0226.907] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0226.907] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0226.907] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WeLDi9-R18mefBa2Uluz.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\weldi9-r18mefba2uluz.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0226.907] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57654C4469392D5231386D6566426132556C757A2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57654c4469392d5231386d6566426132556c757a2e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0226.908] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25d4 [0226.908] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0226.908] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0226.999] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x25d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x25d4, lpOverlapped=0x0) returned 1 [0227.000] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x25e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x25e0, lpOverlapped=0x0) returned 1 [0227.001] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.024] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.036] CloseHandle (hObject=0x104) returned 1 [0227.036] CloseHandle (hObject=0x10c) returned 1 [0227.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WeLDi9-R18mefBa2Uluz.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\weldi9-r18mefba2uluz.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57654C4469392D5231386D6566426132556C757A2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57654c4469392d5231386d6566426132556c757a2e6d6b76.lnk")) returned 0 [0227.037] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57654C4469392D5231386D6566426132556C757A2E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57654c4469392d5231386d6566426132556c757a2e6d6b76.lnk")) returned 0x20 [0227.037] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WeLDi9-R18mefBa2Uluz.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1eb88b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1eb88b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1eb88b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x25d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="WeLDi9-R18mefBa2Uluz.mkv.lnk", cAlternateFileName="WELDI9~1.LNK")) returned 0x325018 [0227.037] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1eb88b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1eb88b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1eb88b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x25d4, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="WeLDi9-R18mefBa2Uluz.mkv.lnk", cAlternateFileName="WELDI9~1.LNK")) returned 0 [0227.037] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0227.037] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WeLDi9-R18mefBa2Uluz.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\weldi9-r18mefba2uluz.mkv.lnk")) returned 1 [0227.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WeLDi9-R18mefBa2Uluz.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\weldi9-r18mefba2uluz.mkv.lnk")) returned 0xffffffff [0227.038] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f88410, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20e3, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="wP_gDRBmCyWmSG7.ots.lnk", cAlternateFileName="WP_GDR~1.LNK")) returned 1 [0227.039] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0227.039] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.039] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0227.039] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0227.039] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0227.039] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.039] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0227.039] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0227.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wP_gDRBmCyWmSG7.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wp_gdrbmcywmsg7.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0227.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\77505F674452426D4379576D5347372E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\77505f674452426d4379576d5347372e6f7473.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0227.041] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20e3 [0227.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0227.041] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0227.131] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x20e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x20e3, lpOverlapped=0x0) returned 1 [0227.132] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x20f0, lpOverlapped=0x0) returned 1 [0227.139] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.162] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.173] CloseHandle (hObject=0x10c) returned 1 [0227.173] CloseHandle (hObject=0x104) returned 1 [0227.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wP_gDRBmCyWmSG7.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wp_gdrbmcywmsg7.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\77505F674452426D4379576D5347372E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\77505f674452426d4379576d5347372e6f7473.lnk")) returned 0 [0227.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\77505F674452426D4379576D5347372E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\77505f674452426d4379576d5347372e6f7473.lnk")) returned 0x20 [0227.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wP_gDRBmCyWmSG7.ots.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f88410, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="wP_gDRBmCyWmSG7.ots.lnk", cAlternateFileName="WP_GDR~1.LNK")) returned 0x325018 [0227.174] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f88410, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f88410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f88410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x20e3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="wP_gDRBmCyWmSG7.ots.lnk", cAlternateFileName="WP_GDR~1.LNK")) returned 0 [0227.174] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0227.174] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wP_gDRBmCyWmSG7.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wp_gdrbmcywmsg7.ots.lnk")) returned 1 [0227.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wP_gDRBmCyWmSG7.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wp_gdrbmcywmsg7.ots.lnk")) returned 0xffffffff [0227.176] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa224a9b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa224a9b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa224a9b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="WQS9UWY.lnk", cAlternateFileName="")) returned 1 [0227.177] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0227.177] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.177] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0227.177] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0227.178] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0227.178] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.178] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0227.178] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0227.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQS9UWY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wqs9uwy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0227.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57515339555759.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57515339555759.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0227.179] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa16 [0227.180] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0227.180] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0227.254] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa16, lpOverlapped=0x0) returned 1 [0227.255] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0227.256] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.279] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.289] CloseHandle (hObject=0x104) returned 1 [0227.290] CloseHandle (hObject=0x10c) returned 1 [0227.290] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQS9UWY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wqs9uwy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57515339555759.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57515339555759.lnk")) returned 0 [0227.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57515339555759.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57515339555759.lnk")) returned 0x20 [0227.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQS9UWY.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa224a9b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa224a9b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa224a9b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="WQS9UWY.lnk", cAlternateFileName="")) returned 0x325018 [0227.291] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa224a9b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa224a9b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa224a9b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="WQS9UWY.lnk", cAlternateFileName="")) returned 0 [0227.291] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0227.291] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQS9UWY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wqs9uwy.lnk")) returned 1 [0227.292] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQS9UWY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wqs9uwy.lnk")) returned 0xffffffff [0227.292] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWeEho0ambdi9j9Uzrzu.lnk", cAlternateFileName="WWEEHO~1.LNK")) returned 1 [0227.293] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0227.293] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.293] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0227.293] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0227.293] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b08c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0227.293] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.293] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b08c) returned 0x10ab [0227.293] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0227.293] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WWeEho0ambdi9j9Uzrzu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wweeho0ambdi9j9uzrzu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0227.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57576545686F30616D626469396A39557A727A75.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57576545686f30616d626469396a39557a727a75.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0227.295] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x306 [0227.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0227.295] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0227.409] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x306, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x306, lpOverlapped=0x0) returned 1 [0227.409] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x310, lpOverlapped=0x0) returned 1 [0227.410] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.433] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.444] CloseHandle (hObject=0x10c) returned 1 [0227.444] CloseHandle (hObject=0x104) returned 1 [0227.444] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WWeEho0ambdi9j9Uzrzu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wweeho0ambdi9j9uzrzu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57576545686F30616D626469396A39557A727A75.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57576545686f30616d626469396a39557a727a75.lnk")) returned 0 [0227.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\57576545686F30616D626469396A39557A727A75.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\57576545686f30616d626469396a39557a727a75.lnk")) returned 0x20 [0227.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WWeEho0ambdi9j9Uzrzu.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="WWeEho0ambdi9j9Uzrzu.lnk", cAlternateFileName="WWEEHO~1.LNK")) returned 0x325018 [0227.445] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa251e3d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa251e3d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa251e3d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="WWeEho0ambdi9j9Uzrzu.lnk", cAlternateFileName="WWEEHO~1.LNK")) returned 0 [0227.445] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0227.445] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WWeEho0ambdi9j9Uzrzu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wweeho0ambdi9j9uzrzu.lnk")) returned 1 [0227.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WWeEho0ambdi9j9Uzrzu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wweeho0ambdi9j9uzrzu.lnk")) returned 0xffffffff [0227.446] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa20cdbf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa20cdbf0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa20f3d50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="X 6TBFvP-nRgliUSwBhE.lnk", cAlternateFileName="X6TBFV~1.LNK")) returned 1 [0227.447] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0227.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0227.447] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0227.447] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b02c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0227.447] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.447] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b02c) returned 0x10ab [0227.447] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0227.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X 6TBFvP-nRgliUSwBhE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x 6tbfvp-nrgliuswbhe.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0227.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\58203654424676502D6E52676C69555377426845.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\58203654424676502d6e52676c69555377426845.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0227.449] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x275 [0227.449] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0227.449] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0227.531] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x275, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x275, lpOverlapped=0x0) returned 1 [0227.532] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x280, lpOverlapped=0x0) returned 1 [0227.533] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.556] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.567] CloseHandle (hObject=0x104) returned 1 [0227.567] CloseHandle (hObject=0x10c) returned 1 [0227.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X 6TBFvP-nRgliUSwBhE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x 6tbfvp-nrgliuswbhe.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\58203654424676502D6E52676C69555377426845.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\58203654424676502d6e52676c69555377426845.lnk")) returned 0 [0227.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\58203654424676502D6E52676C69555377426845.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\58203654424676502d6e52676c69555377426845.lnk")) returned 0x20 [0227.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X 6TBFvP-nRgliUSwBhE.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa20cdbf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa20cdbf0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa20f3d50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="X 6TBFvP-nRgliUSwBhE.lnk", cAlternateFileName="X6TBFV~1.LNK")) returned 0x325018 [0227.568] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa20cdbf0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa20cdbf0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa20f3d50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="X 6TBFvP-nRgliUSwBhE.lnk", cAlternateFileName="X6TBFV~1.LNK")) returned 0 [0227.568] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0227.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X 6TBFvP-nRgliUSwBhE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x 6tbfvp-nrgliuswbhe.lnk")) returned 1 [0227.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X 6TBFvP-nRgliUSwBhE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x 6tbfvp-nrgliuswbhe.lnk")) returned 0xffffffff [0227.569] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ac5810, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ac5810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ac5810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="XQbKram9QifBFWu8vxq.lnk", cAlternateFileName="XQBKRA~1.LNK")) returned 1 [0227.570] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0227.570] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.570] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0227.570] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0227.570] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0227.570] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.570] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0227.570] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0227.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XQbKram9QifBFWu8vxq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqbkram9qifbfwu8vxq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0227.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5851624B72616D395169664246577538767871.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5851624b72616d395169664246577538767871.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0227.572] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7a [0227.572] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0227.572] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0227.689] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa7a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa7a, lpOverlapped=0x0) returned 1 [0227.690] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa80, lpOverlapped=0x0) returned 1 [0227.691] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.715] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.726] CloseHandle (hObject=0x10c) returned 1 [0227.726] CloseHandle (hObject=0x104) returned 1 [0227.726] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XQbKram9QifBFWu8vxq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqbkram9qifbfwu8vxq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5851624B72616D395169664246577538767871.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5851624b72616d395169664246577538767871.lnk")) returned 0 [0227.727] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5851624B72616D395169664246577538767871.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5851624b72616d395169664246577538767871.lnk")) returned 0x20 [0227.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XQbKram9QifBFWu8vxq.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ac5810, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ac5810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ac5810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="XQbKram9QifBFWu8vxq.lnk", cAlternateFileName="XQBKRA~1.LNK")) returned 0x325018 [0227.727] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ac5810, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ac5810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2ac5810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="XQbKram9QifBFWu8vxq.lnk", cAlternateFileName="XQBKRA~1.LNK")) returned 0 [0227.727] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0227.727] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XQbKram9QifBFWu8vxq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqbkram9qifbfwu8vxq.lnk")) returned 1 [0227.728] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XQbKram9QifBFWu8vxq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqbkram9qifbfwu8vxq.lnk")) returned 0xffffffff [0227.728] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c1c470, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c1c470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c1c470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="x_097aYdjnpcs.lnk", cAlternateFileName="X_097A~1.LNK")) returned 1 [0227.729] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0227.729] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.729] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0227.729] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0227.729] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b024, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0227.730] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.730] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b024) returned 0x10ab [0227.730] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0227.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x_097aYdjnpcs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x_097aydjnpcs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0227.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\785F3039376159646A6E706373.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\785f3039376159646a6e706373.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0227.731] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa58 [0227.731] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0227.731] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0227.820] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa58, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa58, lpOverlapped=0x0) returned 1 [0227.820] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa60, lpOverlapped=0x0) returned 1 [0227.821] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.845] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.856] CloseHandle (hObject=0x104) returned 1 [0227.856] CloseHandle (hObject=0x10c) returned 1 [0227.857] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x_097aYdjnpcs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x_097aydjnpcs.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\785F3039376159646A6E706373.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\785f3039376159646a6e706373.lnk")) returned 0 [0227.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\785F3039376159646A6E706373.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\785f3039376159646a6e706373.lnk")) returned 0x20 [0227.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x_097aYdjnpcs.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c1c470, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c1c470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c1c470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="x_097aYdjnpcs.lnk", cAlternateFileName="X_097A~1.LNK")) returned 0x325018 [0227.858] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c1c470, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c1c470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c1c470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="x_097aYdjnpcs.lnk", cAlternateFileName="X_097A~1.LNK")) returned 0 [0227.858] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0227.858] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x_097aYdjnpcs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x_097aydjnpcs.lnk")) returned 1 [0227.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x_097aYdjnpcs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x_097aydjnpcs.lnk")) returned 0xffffffff [0227.859] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1108a30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1108a30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1108a30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x0, dwReserved1=0x0, cFileName="y61 MGhTuO.lnk", cAlternateFileName="Y61MGH~1.LNK")) returned 1 [0227.860] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0227.860] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.860] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0227.860] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0227.860] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0227.860] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.860] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0227.860] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0227.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y61 MGhTuO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y61 mghtuo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0227.861] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\793631204D476854754F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\793631204d476854754f.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0227.862] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa30 [0227.862] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0227.862] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0227.952] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa30, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa30, lpOverlapped=0x0) returned 1 [0227.952] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa40, lpOverlapped=0x0) returned 1 [0227.953] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.982] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.992] CloseHandle (hObject=0x10c) returned 1 [0227.993] CloseHandle (hObject=0x104) returned 1 [0227.993] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y61 MGhTuO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y61 mghtuo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\793631204D476854754F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\793631204d476854754f.lnk")) returned 0 [0227.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\793631204D476854754F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\793631204d476854754f.lnk")) returned 0x20 [0227.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y61 MGhTuO.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1108a30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1108a30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1108a30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="y61 MGhTuO.lnk", cAlternateFileName="Y61MGH~1.LNK")) returned 0x325018 [0227.994] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1108a30, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1108a30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1108a30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="y61 MGhTuO.lnk", cAlternateFileName="Y61MGH~1.LNK")) returned 0 [0227.994] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0227.994] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y61 MGhTuO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y61 mghtuo.lnk")) returned 1 [0227.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y61 MGhTuO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y61 mghtuo.lnk")) returned 0xffffffff [0227.995] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa264eed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa264eed0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa264eed0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="y6U_i.mkv.lnk", cAlternateFileName="Y6U_IM~1.LNK")) returned 1 [0227.997] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0227.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0227.997] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0227.997] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0227.997] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0227.997] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0227.997] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0227.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y6U_i.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y6u_i.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0227.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7936555F692E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7936555f692e6d6b76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0228.004] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x226 [0228.004] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0228.004] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0228.077] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x226, lpOverlapped=0x0) returned 1 [0228.078] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x230, lpOverlapped=0x0) returned 1 [0228.079] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.103] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.114] CloseHandle (hObject=0x104) returned 1 [0228.114] CloseHandle (hObject=0x10c) returned 1 [0228.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y6U_i.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y6u_i.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7936555F692E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7936555f692e6d6b76.lnk")) returned 0 [0228.115] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7936555F692E6D6B76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7936555f692e6d6b76.lnk")) returned 0x20 [0228.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y6U_i.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa264eed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa264eed0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa264eed0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="y6U_i.mkv.lnk", cAlternateFileName="Y6U_IM~1.LNK")) returned 0x325018 [0228.116] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa264eed0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa264eed0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa264eed0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="y6U_i.mkv.lnk", cAlternateFileName="Y6U_IM~1.LNK")) returned 0 [0228.116] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0228.116] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y6U_i.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y6u_i.mkv.lnk")) returned 1 [0228.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y6U_i.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y6u_i.mkv.lnk")) returned 0xffffffff [0228.117] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ef0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b83ef0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1a77, dwReserved0=0x0, dwReserved1=0x0, cFileName="y7yT.ots.lnk", cAlternateFileName="Y7YTOT~1.LNK")) returned 1 [0228.117] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0228.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0228.118] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0228.118] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0228.118] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.118] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0228.118] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0228.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y7yT.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y7yt.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0228.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\793779542E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\793779542e6f7473.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0228.119] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a77 [0228.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0228.120] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0228.208] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a77, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1a77, lpOverlapped=0x0) returned 1 [0228.209] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a80, lpOverlapped=0x0) returned 1 [0228.210] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.232] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.243] CloseHandle (hObject=0x10c) returned 1 [0228.243] CloseHandle (hObject=0x104) returned 1 [0228.243] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y7yT.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y7yt.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\793779542E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\793779542e6f7473.lnk")) returned 0 [0228.244] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\793779542E6F7473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\793779542e6f7473.lnk")) returned 0x20 [0228.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y7yT.ots.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ef0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b83ef0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1a77, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="y7yT.ots.lnk", cAlternateFileName="Y7YTOT~1.LNK")) returned 0x325018 [0228.244] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ef0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2b83ef0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2b83ef0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1a77, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="y7yT.ots.lnk", cAlternateFileName="Y7YTOT~1.LNK")) returned 0 [0228.244] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0228.244] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y7yT.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y7yt.ots.lnk")) returned 1 [0228.245] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y7yT.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y7yt.ots.lnk")) returned 0xffffffff [0228.245] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21fe6f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa21fe6f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21fe6f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ydCYuQ2M.lnk", cAlternateFileName="")) returned 1 [0228.246] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0228.246] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.246] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0228.246] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0228.246] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0228.246] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.246] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0228.246] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0228.246] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ydCYuQ2M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ydcyuq2m.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0228.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\796443597551324D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\796443597551324d.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0228.248] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a40 [0228.248] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0228.248] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0228.334] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1a40, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1a40, lpOverlapped=0x0) returned 1 [0228.335] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a50, lpOverlapped=0x0) returned 1 [0228.336] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.358] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.374] CloseHandle (hObject=0x104) returned 1 [0228.374] CloseHandle (hObject=0x10c) returned 1 [0228.375] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ydCYuQ2M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ydcyuq2m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\796443597551324D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\796443597551324d.lnk")) returned 0 [0228.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\796443597551324D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\796443597551324d.lnk")) returned 0x20 [0228.394] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ydCYuQ2M.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21fe6f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa21fe6f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21fe6f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1a40, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ydCYuQ2M.lnk", cAlternateFileName="")) returned 0x325018 [0228.394] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21fe6f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa21fe6f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21fe6f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1a40, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ydCYuQ2M.lnk", cAlternateFileName="")) returned 0 [0228.394] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0228.394] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ydCYuQ2M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ydcyuq2m.lnk")) returned 1 [0228.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ydCYuQ2M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ydcyuq2m.lnk")) returned 0xffffffff [0228.396] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d730d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d730d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d730d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="YDtdRiM.lnk", cAlternateFileName="")) returned 1 [0228.397] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0228.397] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.397] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0228.397] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0228.397] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0228.397] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.397] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0228.397] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0228.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YDtdRiM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ydtdrim.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0228.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5944746452694D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5944746452694d.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0228.400] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f6 [0228.400] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0228.400] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0228.487] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9f6, lpOverlapped=0x0) returned 1 [0228.488] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0228.489] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.511] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.534] CloseHandle (hObject=0x10c) returned 1 [0228.534] CloseHandle (hObject=0x104) returned 1 [0228.534] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YDtdRiM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ydtdrim.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5944746452694D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5944746452694d.lnk")) returned 0 [0228.535] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5944746452694D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5944746452694d.lnk")) returned 0x20 [0228.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YDtdRiM.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d730d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d730d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d730d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="YDtdRiM.lnk", cAlternateFileName="")) returned 0x325018 [0228.535] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d730d0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2d730d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2d730d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="YDtdRiM.lnk", cAlternateFileName="")) returned 0 [0228.535] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0228.536] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YDtdRiM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ydtdrim.lnk")) returned 1 [0228.536] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YDtdRiM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ydtdrim.lnk")) returned 0xffffffff [0228.536] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1b72a70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2dbf390, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2dbf390, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ynvyy2nEvZalx.lnk", cAlternateFileName="YNVYY2~1.LNK")) returned 1 [0228.537] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0228.537] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.537] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0228.537] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0228.538] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0228.538] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.538] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0228.538] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0228.538] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ynvyy2nEvZalx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynvyy2nevzalx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0228.538] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\596E767979326E45765A616C78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\596e767979326e45765a616c78.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0228.539] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ee [0228.539] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0228.540] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0228.631] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1ee, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1ee, lpOverlapped=0x0) returned 1 [0228.631] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1f0, lpOverlapped=0x0) returned 1 [0228.632] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.655] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.666] CloseHandle (hObject=0x104) returned 1 [0228.666] CloseHandle (hObject=0x10c) returned 1 [0228.667] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ynvyy2nEvZalx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynvyy2nevzalx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\596E767979326E45765A616C78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\596e767979326e45765a616c78.lnk")) returned 0 [0228.668] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\596E767979326E45765A616C78.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\596e767979326e45765a616c78.lnk")) returned 0x20 [0228.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ynvyy2nEvZalx.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1b72a70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2dbf390, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2dbf390, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Ynvyy2nEvZalx.lnk", cAlternateFileName="YNVYY2~1.LNK")) returned 0x325018 [0228.668] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1b72a70, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2dbf390, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2dbf390, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Ynvyy2nEvZalx.lnk", cAlternateFileName="YNVYY2~1.LNK")) returned 0 [0228.668] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0228.668] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ynvyy2nEvZalx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynvyy2nevzalx.lnk")) returned 1 [0228.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ynvyy2nEvZalx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynvyy2nevzalx.lnk")) returned 0xffffffff [0228.669] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2864210, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2864210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2864210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yr_xbxGFFogXHfA.lnk", cAlternateFileName="YR_XBX~1.LNK")) returned 1 [0228.670] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0228.670] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.670] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0228.670] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0228.670] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0228.670] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.670] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0228.670] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0228.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yr_xbxGFFogXHfA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yr_xbxgffogxhfa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0228.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\59725F7862784746466F6758486641.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\59725f7862784746466f6758486641.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0228.672] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa4e [0228.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0228.672] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0228.761] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa4e, lpOverlapped=0x0) returned 1 [0228.762] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa50, lpOverlapped=0x0) returned 1 [0228.763] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.786] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.797] CloseHandle (hObject=0x10c) returned 1 [0228.797] CloseHandle (hObject=0x104) returned 1 [0228.797] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yr_xbxGFFogXHfA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yr_xbxgffogxhfa.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\59725F7862784746466F6758486641.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\59725f7862784746466f6758486641.lnk")) returned 0 [0228.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\59725F7862784746466F6758486641.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\59725f7862784746466f6758486641.lnk")) returned 0x20 [0228.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yr_xbxGFFogXHfA.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2864210, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2864210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2864210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Yr_xbxGFFogXHfA.lnk", cAlternateFileName="YR_XBX~1.LNK")) returned 0x325018 [0228.798] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2864210, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2864210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2864210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Yr_xbxGFFogXHfA.lnk", cAlternateFileName="YR_XBX~1.LNK")) returned 0 [0228.798] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0228.798] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yr_xbxGFFogXHfA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yr_xbxgffogxhfa.lnk")) returned 1 [0228.799] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yr_xbxGFFogXHfA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yr_xbxgffogxhfa.lnk")) returned 0xffffffff [0228.799] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2759870, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZy1uEfpD3CWNcpqF.lnk", cAlternateFileName="YZY1UE~1.LNK")) returned 1 [0228.800] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0228.800] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.800] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0228.800] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0228.801] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b06c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0228.801] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.801] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b06c) returned 0x10ab [0228.801] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0228.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YZy1uEfpD3CWNcpqF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yzy1uefpd3cwncpqf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0228.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\595A793175456670443343574E63707146.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\595a793175456670443343574e63707146.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0228.802] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8f [0228.802] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0228.803] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0228.878] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe8f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe8f, lpOverlapped=0x0) returned 1 [0228.879] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xe90, lpOverlapped=0x0) returned 1 [0228.880] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.903] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.914] CloseHandle (hObject=0x104) returned 1 [0228.914] CloseHandle (hObject=0x10c) returned 1 [0228.914] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YZy1uEfpD3CWNcpqF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yzy1uefpd3cwncpqf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\595A793175456670443343574E63707146.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\595a793175456670443343574e63707146.lnk")) returned 0 [0228.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\595A793175456670443343574E63707146.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\595a793175456670443343574e63707146.lnk")) returned 0x20 [0228.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YZy1uEfpD3CWNcpqF.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2759870, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe8f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="YZy1uEfpD3CWNcpqF.lnk", cAlternateFileName="YZY1UE~1.LNK")) returned 0x325018 [0228.915] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2759870, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2f3c150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2f3c150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xe8f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="YZy1uEfpD3CWNcpqF.lnk", cAlternateFileName="YZY1UE~1.LNK")) returned 0 [0228.915] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0228.915] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YZy1uEfpD3CWNcpqF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yzy1uefpd3cwncpqf.lnk")) returned 1 [0228.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YZy1uEfpD3CWNcpqF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yzy1uefpd3cwncpqf.lnk")) returned 0xffffffff [0228.916] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cdab50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="z8xil.lnk", cAlternateFileName="")) returned 1 [0228.917] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0228.917] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.917] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0228.917] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0228.917] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b06c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0228.917] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0228.917] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b06c) returned 0x10ab [0228.917] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0228.919] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z8xil.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z8xil.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0228.919] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A3878696C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a3878696c.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0228.921] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9dc [0228.921] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0228.921] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0229.010] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9dc, lpOverlapped=0x0) returned 1 [0229.010] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x9e0, lpOverlapped=0x0) returned 1 [0229.011] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.034] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.045] CloseHandle (hObject=0x10c) returned 1 [0229.045] CloseHandle (hObject=0x104) returned 1 [0229.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z8xil.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z8xil.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A3878696C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a3878696c.lnk")) returned 0 [0229.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A3878696C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a3878696c.lnk")) returned 0x20 [0229.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z8xil.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cdab50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="z8xil.lnk", cAlternateFileName="")) returned 0x325018 [0229.046] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cdab50, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cdab50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cdab50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="z8xil.lnk", cAlternateFileName="")) returned 0 [0229.046] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0229.046] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z8xil.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z8xil.lnk")) returned 1 [0229.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z8xil.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z8xil.lnk")) returned 0xffffffff [0229.047] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cb49f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cb49f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cb49f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z8yGVfoNq.lnk", cAlternateFileName="Z8YGVF~1.LNK")) returned 1 [0229.048] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0229.048] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.048] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0229.048] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0229.049] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0229.049] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.049] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a0) returned 0x10ab [0229.049] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0229.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z8yGVfoNq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z8ygvfonq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0229.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A38794756666F4E71.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a38794756666f4e71.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0229.050] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0c [0229.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0229.050] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0229.139] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa0c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa0c, lpOverlapped=0x0) returned 1 [0229.140] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa10, lpOverlapped=0x0) returned 1 [0229.141] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.178] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.189] CloseHandle (hObject=0x104) returned 1 [0229.189] CloseHandle (hObject=0x10c) returned 1 [0229.190] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z8yGVfoNq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z8ygvfonq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A38794756666F4E71.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a38794756666f4e71.lnk")) returned 0 [0229.192] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A38794756666F4E71.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a38794756666f4e71.lnk")) returned 0x20 [0229.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z8yGVfoNq.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cb49f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cb49f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cb49f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa0c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Z8yGVfoNq.lnk", cAlternateFileName="Z8YGVF~1.LNK")) returned 0x325018 [0229.192] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cb49f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2cb49f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2cb49f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa0c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Z8yGVfoNq.lnk", cAlternateFileName="Z8YGVF~1.LNK")) returned 0 [0229.192] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0229.192] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z8yGVfoNq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z8ygvfonq.lnk")) returned 1 [0229.194] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z8yGVfoNq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z8ygvfonq.lnk")) returned 0xffffffff [0229.194] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1390190, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1390190, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1390190, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="zBSPYvi.lnk", cAlternateFileName="")) returned 1 [0229.195] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0229.195] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.195] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0229.195] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0229.196] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0229.196] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.196] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0229.196] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0229.196] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zBSPYvi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbspyvi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0229.196] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A425350597669.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a425350597669.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0229.198] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x239 [0229.198] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0229.199] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0229.293] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x239, lpOverlapped=0x0) returned 1 [0229.294] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x240, lpOverlapped=0x0) returned 1 [0229.295] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.318] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.329] CloseHandle (hObject=0x10c) returned 1 [0229.329] CloseHandle (hObject=0x104) returned 1 [0229.329] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zBSPYvi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbspyvi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A425350597669.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a425350597669.lnk")) returned 0 [0229.330] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A425350597669.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a425350597669.lnk")) returned 0x20 [0229.330] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zBSPYvi.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1390190, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1390190, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1390190, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="zBSPYvi.lnk", cAlternateFileName="")) returned 0x325018 [0229.330] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1390190, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1390190, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1390190, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="zBSPYvi.lnk", cAlternateFileName="")) returned 0 [0229.330] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0229.330] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zBSPYvi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbspyvi.lnk")) returned 1 [0229.331] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zBSPYvi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbspyvi.lnk")) returned 0xffffffff [0229.331] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a9f6b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a9f6b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a9f6b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1933, dwReserved0=0x0, dwReserved1=0x0, cFileName="zEhKP8Dca4zsWYqAb.flv.lnk", cAlternateFileName="ZEHKP8~1.LNK")) returned 1 [0229.332] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0229.332] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.332] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0229.332] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0229.333] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b02c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0229.333] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.333] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b02c) returned 0x10ab [0229.333] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0229.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zEhKP8Dca4zsWYqAb.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zehkp8dca4zswyqab.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0229.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A45684B5038446361347A7357597141622E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a45684b5038446361347a7357597141622e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0229.334] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1933 [0229.334] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0229.335] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0229.425] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1933, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1933, lpOverlapped=0x0) returned 1 [0229.426] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1940, lpOverlapped=0x0) returned 1 [0229.427] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.449] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.461] CloseHandle (hObject=0x104) returned 1 [0229.461] CloseHandle (hObject=0x10c) returned 1 [0229.461] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zEhKP8Dca4zsWYqAb.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zehkp8dca4zswyqab.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A45684B5038446361347A7357597141622E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a45684b5038446361347a7357597141622e666c76.lnk")) returned 0 [0229.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7A45684B5038446361347A7357597141622E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a45684b5038446361347a7357597141622e666c76.lnk")) returned 0x20 [0229.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zEhKP8Dca4zsWYqAb.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a9f6b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a9f6b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a9f6b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1933, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="zEhKP8Dca4zsWYqAb.flv.lnk", cAlternateFileName="ZEHKP8~1.LNK")) returned 0x325018 [0229.462] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a9f6b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a9f6b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a9f6b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1933, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="zEhKP8Dca4zsWYqAb.flv.lnk", cAlternateFileName="ZEHKP8~1.LNK")) returned 0 [0229.462] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0229.462] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zEhKP8Dca4zsWYqAb.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zehkp8dca4zswyqab.flv.lnk")) returned 1 [0229.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zEhKP8Dca4zsWYqAb.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zehkp8dca4zswyqab.flv.lnk")) returned 0xffffffff [0229.463] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25dcab0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25dcab0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25dcab0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="ZEmHqhN11qa.lnk", cAlternateFileName="ZEMHQH~1.LNK")) returned 1 [0229.464] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0229.464] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.464] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0229.464] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0229.465] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0229.465] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.465] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0229.465] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0229.465] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZEmHqhN11qa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zemhqhn11qa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0229.465] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A456D4871684E31317161.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a456d4871684e31317161.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0229.466] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x248 [0229.466] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0229.467] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0229.574] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x248, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x248, lpOverlapped=0x0) returned 1 [0229.575] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x250, lpOverlapped=0x0) returned 1 [0229.576] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.646] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.657] CloseHandle (hObject=0x10c) returned 1 [0229.657] CloseHandle (hObject=0x104) returned 1 [0229.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZEmHqhN11qa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zemhqhn11qa.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A456D4871684E31317161.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a456d4871684e31317161.lnk")) returned 0 [0229.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A456D4871684E31317161.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a456d4871684e31317161.lnk")) returned 0x20 [0229.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZEmHqhN11qa.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25dcab0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25dcab0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25dcab0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ZEmHqhN11qa.lnk", cAlternateFileName="ZEMHQH~1.LNK")) returned 0x325018 [0229.658] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25dcab0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa25dcab0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa25dcab0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ZEmHqhN11qa.lnk", cAlternateFileName="ZEMHQH~1.LNK")) returned 0 [0229.658] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0229.658] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZEmHqhN11qa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zemhqhn11qa.lnk")) returned 1 [0229.659] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZEmHqhN11qa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zemhqhn11qa.lnk")) returned 0xffffffff [0229.659] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1c572b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1c572b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zz_jtEUlhSu_IKW3L.lnk", cAlternateFileName="ZZ_JTE~1.LNK")) returned 1 [0229.660] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0229.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0229.660] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0229.660] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b05c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0229.660] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.660] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b05c) returned 0x10ab [0229.660] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0229.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zz_jtEUlhSu_IKW3L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zz_jteulhsu_ikw3l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0229.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A7A5F6A7445556C6853755F494B57334C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a7a5f6a7445556c6853755f494b57334c.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0229.665] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b32 [0229.665] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0229.665] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0229.749] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b32, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1b32, lpOverlapped=0x0) returned 1 [0229.750] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b40, lpOverlapped=0x0) returned 1 [0229.751] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.774] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.785] CloseHandle (hObject=0x104) returned 1 [0229.785] CloseHandle (hObject=0x10c) returned 1 [0229.785] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zz_jtEUlhSu_IKW3L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zz_jteulhsu_ikw3l.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A7A5F6A7445556C6853755F494B57334C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a7a5f6a7445556c6853755f494b57334c.lnk")) returned 0 [0229.786] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5A7A5F6A7445556C6853755F494B57334C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5a7a5f6a7445556c6853755f494b57334c.lnk")) returned 0x20 [0229.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zz_jtEUlhSu_IKW3L.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1c572b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1c572b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1b32, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Zz_jtEUlhSu_IKW3L.lnk", cAlternateFileName="ZZ_JTE~1.LNK")) returned 0x325018 [0229.786] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c572b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1c572b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1c572b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1b32, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Zz_jtEUlhSu_IKW3L.lnk", cAlternateFileName="ZZ_JTE~1.LNK")) returned 0 [0229.786] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0229.787] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zz_jtEUlhSu_IKW3L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zz_jteulhsu_ikw3l.lnk")) returned 1 [0229.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zz_jtEUlhSu_IKW3L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zz_jteulhsu_ikw3l.lnk")) returned 0xffffffff [0229.788] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a533f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a533f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a533f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="_28mTQ5.lnk", cAlternateFileName="")) returned 1 [0229.788] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0229.788] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.788] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0229.788] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0229.789] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0229.789] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.789] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a0) returned 0x10ab [0229.789] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0229.789] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_28mTQ5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_28mtq5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0229.789] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F32386D545135.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f32386d545135.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0229.790] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e8 [0229.791] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0229.791] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0229.881] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3e8, lpOverlapped=0x0) returned 1 [0229.882] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0229.883] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.908] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.920] CloseHandle (hObject=0x10c) returned 1 [0229.920] CloseHandle (hObject=0x104) returned 1 [0229.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_28mTQ5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_28mtq5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F32386D545135.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f32386d545135.lnk")) returned 0 [0229.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F32386D545135.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f32386d545135.lnk")) returned 0x20 [0229.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_28mTQ5.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a533f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a533f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a533f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_28mTQ5.lnk", cAlternateFileName="")) returned 0x325018 [0229.922] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a533f0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2a533f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2a533f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_28mTQ5.lnk", cAlternateFileName="")) returned 0 [0229.922] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0229.922] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_28mTQ5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_28mtq5.lnk")) returned 1 [0229.923] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_28mTQ5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_28mtq5.lnk")) returned 0xffffffff [0229.923] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ac5810, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ac5810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2aeb970, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="_9wUpU7zS-xw3.lnk", cAlternateFileName="_9WUPU~1.LNK")) returned 1 [0229.923] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0229.923] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.923] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0229.923] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0229.924] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b01c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0229.924] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0229.924] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b01c) returned 0x10ab [0229.924] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0229.924] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_9wUpU7zS-xw3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_9wupu7zs-xw3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0229.924] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F3977557055377A532D787733.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f3977557055377a532d787733.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0229.925] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa38 [0229.925] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0229.926] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0230.015] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa38, lpOverlapped=0x0) returned 1 [0230.016] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa40, lpOverlapped=0x0) returned 1 [0230.017] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.040] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.051] CloseHandle (hObject=0x104) returned 1 [0230.051] CloseHandle (hObject=0x10c) returned 1 [0230.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_9wUpU7zS-xw3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_9wupu7zs-xw3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F3977557055377A532D787733.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f3977557055377a532d787733.lnk")) returned 0 [0230.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F3977557055377A532D787733.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f3977557055377a532d787733.lnk")) returned 0x20 [0230.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_9wUpU7zS-xw3.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ac5810, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ac5810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2aeb970, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="_9wUpU7zS-xw3.lnk", cAlternateFileName="_9WUPU~1.LNK")) returned 0x325018 [0230.052] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ac5810, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2ac5810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2aeb970, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="_9wUpU7zS-xw3.lnk", cAlternateFileName="_9WUPU~1.LNK")) returned 0 [0230.052] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0230.052] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_9wUpU7zS-xw3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_9wupu7zs-xw3.lnk")) returned 1 [0230.053] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_9wUpU7zS-xw3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_9wupu7zs-xw3.lnk")) returned 0xffffffff [0230.053] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1806ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="_cP-_edxhC.lnk", cAlternateFileName="_CP-_E~1.LNK")) returned 1 [0230.054] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.054] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.054] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.054] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.055] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.055] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.055] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0230.055] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cP-_edxhC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_cp-_edxhc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0230.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F63502D5F6564786843.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f63502d5f6564786843.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0230.056] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1df [0230.056] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0230.057] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0230.145] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1df, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x1df, lpOverlapped=0x0) returned 1 [0230.146] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e0, lpOverlapped=0x0) returned 1 [0230.147] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.169] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.181] CloseHandle (hObject=0x10c) returned 1 [0230.181] CloseHandle (hObject=0x104) returned 1 [0230.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cP-_edxhC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_cp-_edxhc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F63502D5F6564786843.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f63502d5f6564786843.lnk")) returned 0 [0230.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F63502D5F6564786843.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f63502d5f6564786843.lnk")) returned 0x20 [0230.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cP-_edxhC.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1806ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_cP-_edxhC.lnk", cAlternateFileName="_CP-_E~1.LNK")) returned 0x325018 [0230.182] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1806ad0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2c425d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2c425d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_cP-_edxhC.lnk", cAlternateFileName="_CP-_E~1.LNK")) returned 0 [0230.182] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0230.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cP-_edxhC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_cp-_edxhc.lnk")) returned 1 [0230.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_cP-_edxhC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_cp-_edxhc.lnk")) returned 0xffffffff [0230.183] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2355350, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2355350, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2355350, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_GB3.flv.lnk", cAlternateFileName="_GB3FL~1.LNK")) returned 1 [0230.184] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.184] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.184] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.184] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.184] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.184] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.184] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0230.184] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_GB3.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_gb3.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0230.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F4742332E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f4742332e666c76.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0230.186] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18a0 [0230.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0230.186] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0230.258] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18a0, lpOverlapped=0x0) returned 1 [0230.258] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x18b0, lpOverlapped=0x0) returned 1 [0230.259] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.289] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.299] CloseHandle (hObject=0x104) returned 1 [0230.299] CloseHandle (hObject=0x10c) returned 1 [0230.300] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_GB3.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_gb3.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F4742332E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f4742332e666c76.lnk")) returned 0 [0230.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F4742332E666C76.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f4742332e666c76.lnk")) returned 0x20 [0230.301] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_GB3.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2355350, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2355350, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2355350, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18a0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="_GB3.flv.lnk", cAlternateFileName="_GB3FL~1.LNK")) returned 0x325018 [0230.301] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2355350, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa2355350, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa2355350, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18a0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="_GB3.flv.lnk", cAlternateFileName="_GB3FL~1.LNK")) returned 0 [0230.301] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0230.301] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_GB3.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_gb3.flv.lnk")) returned 1 [0230.302] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_GB3.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_gb3.flv.lnk")) returned 0xffffffff [0230.302] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc790, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28fc790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28fc790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Kx1rzc.lnk", cAlternateFileName="")) returned 1 [0230.303] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.303] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.303] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.303] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.303] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.303] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.303] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0230.304] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Kx1rzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_kx1rzc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0230.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F4B7831727A63.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f4b7831727a63.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0230.305] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa16 [0230.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0230.305] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0230.419] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa16, lpOverlapped=0x0) returned 1 [0230.420] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0230.421] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.443] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.454] CloseHandle (hObject=0x10c) returned 1 [0230.454] CloseHandle (hObject=0x104) returned 1 [0230.455] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Kx1rzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_kx1rzc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F4B7831727A63.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f4b7831727a63.lnk")) returned 0 [0230.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5F4B7831727A63.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5f4b7831727a63.lnk")) returned 0x20 [0230.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Kx1rzc.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc790, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28fc790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28fc790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_Kx1rzc.lnk", cAlternateFileName="")) returned 0x325018 [0230.456] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc790, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28fc790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28fc790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_Kx1rzc.lnk", cAlternateFileName="")) returned 0 [0230.456] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0230.456] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Kx1rzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_kx1rzc.lnk")) returned 1 [0230.457] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Kx1rzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_kx1rzc.lnk")) returned 0xffffffff [0230.457] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc790, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa28fc790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa28fc790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Kx1rzc.lnk", cAlternateFileName="")) returned 0 [0230.457] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0230.457] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6b6e6b, dwReserved1=0x6c2e6b6e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0230.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0230.459] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.459] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0230.460] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.460] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.460] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.460] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.460] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b014, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.460] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.460] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b014) returned 0x10ab [0230.460] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.461] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0230.461] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.461] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.461] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0230.461] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.462] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0230.462] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.462] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.462] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.462] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.462] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0230.462] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0230.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\4465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0230.464] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22e [0230.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0230.465] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0230.543] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x22e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x22e, lpOverlapped=0x0) returned 1 [0230.544] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x230, lpOverlapped=0x0) returned 1 [0230.552] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.574] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.585] CloseHandle (hObject=0x104) returned 1 [0230.585] CloseHandle (hObject=0x10c) returned 1 [0230.585] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\4465736b746f70.ini")) returned 0 [0230.586] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\4465736b746f70.ini")) returned 0x2020 [0230.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x325018 [0230.586] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0230.586] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0230.586] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 1 [0230.587] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0xffffffff [0230.587] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0230.588] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.588] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.588] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.588] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.588] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.588] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.588] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0230.589] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.589] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0230.589] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.589] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.589] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.589] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.589] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.589] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.590] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0230.590] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0230.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\46617820526563697069656E74.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\46617820526563697069656e74.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0230.591] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d6 [0230.591] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0230.591] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0230.682] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x4d6, lpOverlapped=0x0) returned 1 [0230.684] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0230.685] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.707] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.718] CloseHandle (hObject=0x10c) returned 1 [0230.718] CloseHandle (hObject=0x104) returned 1 [0230.718] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\46617820526563697069656E74.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\46617820526563697069656e74.lnk")) returned 0 [0230.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\46617820526563697069656E74.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\46617820526563697069656e74.lnk")) returned 0x2020 [0230.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0x325018 [0230.719] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0 [0230.719] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0230.719] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 1 [0230.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 0xffffffff [0230.720] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0230.721] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.721] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.721] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.721] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.722] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afd4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.722] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.722] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afd4) returned 0x10ab [0230.722] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.722] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0230.722] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0230.722] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0230.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0230.722] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="..", cAlternateFileName="")) returned 1 [0230.722] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0230.723] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.723] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.723] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.723] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.723] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.723] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.723] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0230.723] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0230.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0230.725] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0230.725] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0230.725] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0230.819] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xae, lpOverlapped=0x0) returned 1 [0230.820] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xb0, lpOverlapped=0x0) returned 1 [0230.824] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.846] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.859] CloseHandle (hObject=0x104) returned 1 [0230.860] CloseHandle (hObject=0x10c) returned 1 [0230.862] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\6465736b746f70.ini")) returned 0 [0230.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\6465736b746f70.ini")) returned 0x20 [0230.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325018 [0230.863] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0230.863] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0230.863] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0230.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 0xffffffff [0230.864] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0230.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae00ac, dwReserved1=0x335f48, cFileName=".", cAlternateFileName="")) returned 0x325018 [0230.864] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae00ac, dwReserved1=0x335f48, cFileName="..", cAlternateFileName="")) returned 1 [0230.865] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae00ac, dwReserved1=0x335f48, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0230.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0230.865] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.865] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0230.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325098 [0230.865] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.865] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0230.868] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0230.868] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0230.871] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0230.871] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0230.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0230.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0230.871] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0230.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0230.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0230.873] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c0 [0230.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0230.873] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0230.962] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2c0, lpOverlapped=0x0) returned 1 [0230.963] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2d0, lpOverlapped=0x0) returned 1 [0230.964] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.986] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.996] CloseHandle (hObject=0x100) returned 1 [0230.996] CloseHandle (hObject=0x110) returned 1 [0230.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4465736b746f70.ini")) returned 0 [0230.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4465736b746f70.ini")) returned 0x20 [0230.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x3250d8 [0230.998] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0230.998] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0230.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 1 [0230.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0xffffffff [0230.999] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1 [0231.000] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0231.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0231.000] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0231.000] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0231.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0231.001] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0231.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0231.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\45617365206F6620416363657373.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\45617365206f6620416363657373.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0231.003] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54e [0231.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0231.004] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0231.075] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x54e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x54e, lpOverlapped=0x0) returned 1 [0231.084] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x550, lpOverlapped=0x0) returned 1 [0231.085] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.107] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.118] CloseHandle (hObject=0x110) returned 1 [0231.118] CloseHandle (hObject=0x100) returned 1 [0231.118] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\45617365206F6620416363657373.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\45617365206f6620416363657373.lnk")) returned 0 [0231.119] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\45617365206F6620416363657373.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\45617365206f6620416363657373.lnk")) returned 0x20 [0231.119] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0x3250d8 [0231.119] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0 [0231.120] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0231.120] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 1 [0231.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 0xffffffff [0231.121] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0231.121] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0231.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0231.122] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0231.122] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0231.122] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.122] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0231.122] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0231.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0231.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4D61676E696679.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4d61676e696679.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0231.125] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ea [0231.125] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0231.125] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0231.215] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4ea, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x4ea, lpOverlapped=0x0) returned 1 [0231.217] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x4f0, lpOverlapped=0x0) returned 1 [0231.218] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.240] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.251] CloseHandle (hObject=0x100) returned 1 [0231.251] CloseHandle (hObject=0x110) returned 1 [0231.251] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4D61676E696679.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4d61676e696679.lnk")) returned 0 [0231.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4D61676E696679.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4d61676e696679.lnk")) returned 0x20 [0231.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0x3250d8 [0231.252] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0 [0231.252] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0231.253] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 1 [0231.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 0xffffffff [0231.253] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0231.254] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0231.254] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.254] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0231.254] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0231.255] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0231.255] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.255] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0231.255] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0231.255] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0231.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4E61727261746F72.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4e61727261746f72.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0231.257] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ee [0231.257] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0231.257] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0231.346] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x4ee, lpOverlapped=0x0) returned 1 [0231.352] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x4f0, lpOverlapped=0x0) returned 1 [0231.353] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.375] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.386] CloseHandle (hObject=0x110) returned 1 [0231.386] CloseHandle (hObject=0x100) returned 1 [0231.387] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4E61727261746F72.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4e61727261746f72.lnk")) returned 0 [0231.404] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4E61727261746F72.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4e61727261746f72.lnk")) returned 0x20 [0231.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0x3250d8 [0231.404] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0 [0231.404] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0231.404] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 1 [0231.405] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 0xffffffff [0231.405] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0231.406] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0231.406] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.406] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0231.406] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0231.406] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0231.406] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.406] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0231.406] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0231.407] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0231.407] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4F6E2D53637265656E204B6579626F617264.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4f6e2d53637265656e204b6579626f617264.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0231.409] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e2 [0231.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0231.409] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0231.488] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x4e2, lpOverlapped=0x0) returned 1 [0231.490] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x4f0, lpOverlapped=0x0) returned 1 [0231.491] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.513] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.523] CloseHandle (hObject=0x100) returned 1 [0231.523] CloseHandle (hObject=0x110) returned 1 [0231.523] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4F6E2D53637265656E204B6579626F617264.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4f6e2d53637265656e204b6579626f617264.lnk")) returned 0 [0231.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\4F6E2D53637265656E204B6579626F617264.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\4f6e2d53637265656e204b6579626f617264.lnk")) returned 0x20 [0231.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0x3250d8 [0231.525] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0231.525] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0231.525] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 1 [0231.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 0xffffffff [0231.526] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0231.526] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0231.526] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0231.527] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0231.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0231.527] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0231.527] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0231.527] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.527] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0231.527] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0231.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0231.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\436F6D6D616E642050726F6D7074.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\436f6d6d616e642050726f6d7074.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0231.530] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x500 [0231.530] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0231.530] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0231.673] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x500, lpOverlapped=0x0) returned 1 [0231.674] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x510, lpOverlapped=0x0) returned 1 [0231.675] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.697] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.708] CloseHandle (hObject=0x108) returned 1 [0231.708] CloseHandle (hObject=0x110) returned 1 [0231.708] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\436F6D6D616E642050726F6D7074.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\436f6d6d616e642050726f6d7074.lnk")) returned 0 [0231.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\436F6D6D616E642050726F6D7074.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\436f6d6d616e642050726f6d7074.lnk")) returned 0x20 [0231.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0x325098 [0231.709] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0 [0231.709] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0231.709] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 1 [0231.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 0xffffffff [0231.710] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0231.711] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0231.711] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.711] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0231.711] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0231.711] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0231.711] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.711] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0231.711] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0231.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0231.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\4465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0231.713] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a6 [0231.713] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0231.713] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0231.805] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2a6, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x2a6, lpOverlapped=0x0) returned 1 [0231.805] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x2b0, lpOverlapped=0x0) returned 1 [0231.806] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.828] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.839] CloseHandle (hObject=0x110) returned 1 [0231.839] CloseHandle (hObject=0x108) returned 1 [0231.839] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\4465736b746f70.ini")) returned 0 [0231.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\4465736b746f70.ini")) returned 0x20 [0231.840] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x325098 [0231.840] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0231.840] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0231.840] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0231.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0231.841] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0231.842] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0231.842] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.842] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0231.842] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0231.842] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0231.842] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.842] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0231.842] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0231.842] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0231.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\4E6F7465706164.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\4e6f7465706164.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0231.845] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x518 [0231.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0231.845] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0231.920] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x518, lpOverlapped=0x0) returned 1 [0231.926] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x520, lpOverlapped=0x0) returned 1 [0231.927] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.949] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.960] CloseHandle (hObject=0x108) returned 1 [0231.960] CloseHandle (hObject=0x110) returned 1 [0231.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\4E6F7465706164.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\4e6f7465706164.lnk")) returned 0 [0231.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\4E6F7465706164.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\4e6f7465706164.lnk")) returned 0x20 [0231.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0x325098 [0231.961] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0231.961] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0231.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 1 [0231.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0xffffffff [0231.962] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0231.963] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0231.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0231.963] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0231.963] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0231.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0231.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0231.963] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0231.964] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0231.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\52756E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\52756e.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0231.966] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0231.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0231.966] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0232.052] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x106, lpOverlapped=0x0) returned 1 [0232.053] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x110, lpOverlapped=0x0) returned 1 [0232.054] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.075] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.086] CloseHandle (hObject=0x110) returned 1 [0232.086] CloseHandle (hObject=0x108) returned 1 [0232.086] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\52756E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\52756e.lnk")) returned 0 [0232.087] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\52756E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\52756e.lnk")) returned 0x20 [0232.087] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Run.lnk", cAlternateFileName="")) returned 0x325098 [0232.087] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0232.087] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0232.087] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 1 [0232.088] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 0xffffffff [0232.088] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0232.088] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd000ce, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325098 [0232.089] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd000ce, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0232.089] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0xd000ce, dwReserved1=0x31c7f8, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0232.089] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0232.090] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.090] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0232.090] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0232.090] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0232.090] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.090] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0232.090] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0232.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0232.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\636F6D7075746572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\636f6d7075746572.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0232.092] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0232.092] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0232.092] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0232.187] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x106, lpOverlapped=0x0) returned 1 [0232.189] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x110, lpOverlapped=0x0) returned 1 [0232.190] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.213] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.224] CloseHandle (hObject=0x110) returned 1 [0232.224] CloseHandle (hObject=0x100) returned 1 [0232.225] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\636F6D7075746572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\636f6d7075746572.lnk")) returned 0 [0232.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\636F6D7075746572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\636f6d7075746572.lnk")) returned 0x20 [0232.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="computer.lnk", cAlternateFileName="")) returned 0x3250d8 [0232.227] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="computer.lnk", cAlternateFileName="")) returned 0 [0232.227] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0232.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 1 [0232.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 0xffffffff [0232.228] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0232.229] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0232.229] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0232.230] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0232.230] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0232.230] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.230] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0232.231] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0232.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0232.232] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\436F6E74726F6C2050616E656C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\436f6e74726f6c2050616e656c.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0232.233] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0232.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0232.234] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0232.321] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x106, lpOverlapped=0x0) returned 1 [0232.323] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x110, lpOverlapped=0x0) returned 1 [0232.324] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.346] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.357] CloseHandle (hObject=0x100) returned 1 [0232.358] CloseHandle (hObject=0x110) returned 1 [0232.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\436F6E74726F6C2050616E656C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\436f6e74726f6c2050616e656c.lnk")) returned 0 [0232.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\436F6E74726F6C2050616E656C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\436f6e74726f6c2050616e656c.lnk")) returned 0x20 [0232.359] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0x3250d8 [0232.359] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0 [0232.359] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0232.359] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 1 [0232.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 0xffffffff [0232.360] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0232.361] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0232.361] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.361] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0232.361] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0232.361] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0232.361] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.361] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0232.361] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0232.362] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0232.362] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\4465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0232.363] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e2 [0232.363] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0232.363] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0232.446] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x2e2, lpOverlapped=0x0) returned 1 [0232.447] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x2f0, lpOverlapped=0x0) returned 1 [0232.449] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.471] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.482] CloseHandle (hObject=0x110) returned 1 [0232.482] CloseHandle (hObject=0x100) returned 1 [0232.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\4465736b746f70.ini")) returned 0 [0232.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\4465736b746f70.ini")) returned 0x20 [0232.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x3250d8 [0232.483] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0232.483] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0232.484] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0232.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0xffffffff [0232.485] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0232.485] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0232.485] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0232.486] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0232.486] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0232.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0232.486] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0232.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0232.487] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\496E7465726E6574204578706C6F72657220284E6F204164642D6F6E7329.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\496e7465726e6574204578706c6f72657220284e6f204164642d6f6e7329.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0232.488] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5df [0232.488] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0232.488] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0232.594] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5df, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x5df, lpOverlapped=0x0) returned 1 [0232.597] WriteFile (in: hFile=0x110, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x5e0, lpOverlapped=0x0) returned 1 [0232.598] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.620] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.630] CloseHandle (hObject=0x100) returned 1 [0232.630] CloseHandle (hObject=0x110) returned 1 [0232.630] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\496E7465726E6574204578706C6F72657220284E6F204164642D6F6E7329.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\496e7465726e6574204578706c6f72657220284e6f204164642d6f6e7329.lnk")) returned 0 [0232.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\496E7465726E6574204578706C6F72657220284E6F204164642D6F6E7329.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\496e7465726e6574204578706c6f72657220284e6f204164642d6f6e7329.lnk")) returned 0x20 [0232.632] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x3250d8 [0232.632] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0232.632] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0232.632] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 1 [0232.633] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 0xffffffff [0232.633] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 1 [0232.633] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0232.633] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.633] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0232.633] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0232.634] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0232.634] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.634] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0232.634] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0232.634] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0232.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\507269766174652043686172616374657220456469746F72.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\507269766174652043686172616374657220456469746f72.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0232.636] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51a [0232.636] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0232.637] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0232.723] ReadFile (in: hFile=0x110, lpBuffer=0x280000c, nNumberOfBytesToRead=0x51a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e430*=0x51a, lpOverlapped=0x0) returned 1 [0232.725] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e430*=0x520, lpOverlapped=0x0) returned 1 [0232.726] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.748] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.759] CloseHandle (hObject=0x110) returned 1 [0232.759] CloseHandle (hObject=0x100) returned 1 [0232.759] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\507269766174652043686172616374657220456469746F72.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\507269766174652043686172616374657220456469746f72.lnk")) returned 0 [0232.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\507269766174652043686172616374657220456469746F72.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\507269766174652043686172616374657220456469746f72.lnk")) returned 0x20 [0232.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0x3250d8 [0232.761] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0232.761] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0232.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 1 [0232.762] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 0xffffffff [0232.762] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x7735387a, dwReserved1=0x7758bff3, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0232.762] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0232.762] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0232.762] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0232.763] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0232.763] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0232.763] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0232.763] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0232.763] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0232.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0232.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\57696E646F7773204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\57696e646f7773204578706c6f726572.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0232.765] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0232.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0232.766] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0232.839] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x4cc, lpOverlapped=0x0) returned 1 [0232.840] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x4d0, lpOverlapped=0x0) returned 1 [0232.841] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.863] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.874] CloseHandle (hObject=0x108) returned 1 [0232.874] CloseHandle (hObject=0x100) returned 1 [0232.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\57696E646F7773204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\57696e646f7773204578706c6f726572.lnk")) returned 0 [0232.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\57696E646F7773204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\57696e646f7773204578706c6f726572.lnk")) returned 0x20 [0232.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x325098 [0232.875] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0232.875] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0232.875] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 1 [0232.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 0xffffffff [0232.876] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0232.876] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0232.876] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0232.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0232.877] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.877] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0232.877] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0232.877] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.877] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0232.877] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0232.878] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0232.878] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0232.878] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0232.878] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0232.878] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0232.878] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0232.879] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0232.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0232.880] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0232.969] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0xae, lpOverlapped=0x0) returned 1 [0232.970] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xb0, lpOverlapped=0x0) returned 1 [0232.971] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.992] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.003] CloseHandle (hObject=0x100) returned 1 [0233.003] CloseHandle (hObject=0x108) returned 1 [0233.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\6465736b746f70.ini")) returned 0 [0233.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\6465736b746f70.ini")) returned 0x20 [0233.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325098 [0233.004] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0233.004] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0233.004] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0233.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0xffffffff [0233.005] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0233.005] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0233.005] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0233.006] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0233.006] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.006] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0233.006] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0233.006] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0233.006] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.007] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0233.007] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0233.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0233.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0233.008] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dc [0233.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0233.008] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0233.100] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1dc, lpOverlapped=0x0) returned 1 [0233.102] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x1e0, lpOverlapped=0x0) returned 1 [0233.104] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.126] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.137] CloseHandle (hObject=0x104) returned 1 [0233.137] CloseHandle (hObject=0x108) returned 1 [0233.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\6465736b746f70.ini")) returned 0 [0233.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\6465736b746f70.ini")) returned 0x20 [0233.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325058 [0233.139] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0233.139] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0233.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0233.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0xffffffff [0233.140] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0233.141] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0233.141] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.141] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0233.141] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0233.141] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0233.141] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.141] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0233.141] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0233.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0233.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\496E7465726E6574204578706C6F726572202836342D62697429.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\496e7465726e6574204578706c6f726572202836342d62697429.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0233.144] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58b [0233.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0233.144] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0233.231] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x58b, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x58b, lpOverlapped=0x0) returned 1 [0233.235] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x590, lpOverlapped=0x0) returned 1 [0233.236] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.257] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.268] CloseHandle (hObject=0x108) returned 1 [0233.268] CloseHandle (hObject=0x104) returned 1 [0233.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\496E7465726E6574204578706C6F726572202836342D62697429.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\496e7465726e6574204578706c6f726572202836342d62697429.lnk")) returned 0 [0233.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\496E7465726E6574204578706C6F726572202836342D62697429.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\496e7465726e6574204578706c6f726572202836342d62697429.lnk")) returned 0x20 [0233.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x325058 [0233.269] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0233.269] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0233.269] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 1 [0233.270] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 0xffffffff [0233.270] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0233.271] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0233.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0233.271] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0233.271] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0233.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0233.271] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0233.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0233.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\496E7465726E6574204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\496e7465726e6574204578706c6f726572.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0233.273] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ad [0233.273] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0233.273] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0233.344] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x5ad, lpOverlapped=0x0) returned 1 [0233.345] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x5b0, lpOverlapped=0x0) returned 1 [0233.346] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.368] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.379] CloseHandle (hObject=0x104) returned 1 [0233.379] CloseHandle (hObject=0x108) returned 1 [0233.379] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\496E7465726E6574204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\496e7465726e6574204578706c6f726572.lnk")) returned 0 [0233.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\496E7465726E6574204578706C6F726572.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\496e7465726e6574204578706c6f726572.lnk")) returned 0x20 [0233.380] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x325058 [0233.380] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0233.380] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0233.380] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 1 [0233.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 0xffffffff [0233.381] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0233.381] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd400d2, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325058 [0233.381] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd400d2, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0233.381] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0xd400d2, dwReserved1=0x31c7f8, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0233.382] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0233.382] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.382] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0233.382] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0233.382] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0233.382] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.382] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0233.382] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0233.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0233.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\4465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0233.404] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0233.404] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0233.404] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0233.485] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x13e, lpOverlapped=0x0) returned 1 [0233.486] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x140, lpOverlapped=0x0) returned 1 [0233.487] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.515] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.526] CloseHandle (hObject=0x104) returned 1 [0233.526] CloseHandle (hObject=0x100) returned 1 [0233.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\4465736b746f70.ini")) returned 0 [0233.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\4465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\4465736b746f70.ini")) returned 0x20 [0233.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x325098 [0233.527] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0233.528] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0233.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0233.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0233.528] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Help.lnk", cAlternateFileName="")) returned 1 [0233.529] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0233.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.529] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0233.529] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0233.529] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0233.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.529] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0233.530] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0233.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0233.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\48656C70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\48656c70.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0233.532] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0233.532] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0233.532] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0233.645] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x106, lpOverlapped=0x0) returned 1 [0233.719] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x110, lpOverlapped=0x0) returned 1 [0233.720] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.742] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.752] CloseHandle (hObject=0x100) returned 1 [0233.752] CloseHandle (hObject=0x104) returned 1 [0233.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\48656C70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\48656c70.lnk")) returned 0 [0233.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\48656C70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\48656c70.lnk")) returned 0x20 [0233.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Help.lnk", cAlternateFileName="")) returned 0x325098 [0233.754] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0233.754] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0233.754] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 1 [0233.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 0xffffffff [0233.755] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0233.755] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0233.755] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Startup", cAlternateFileName="")) returned 1 [0233.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName=".", cAlternateFileName="")) returned 0x325058 [0233.755] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="..", cAlternateFileName="")) returned 1 [0233.755] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0233.755] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0233.755] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.756] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0233.756] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0233.756] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b044, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0233.756] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.756] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b044) returned 0x10ab [0233.756] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0233.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0233.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0233.758] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0233.758] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0233.758] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0233.841] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0xae, lpOverlapped=0x0) returned 1 [0233.841] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xb0, lpOverlapped=0x0) returned 1 [0233.842] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.864] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.875] CloseHandle (hObject=0x104) returned 1 [0233.875] CloseHandle (hObject=0x100) returned 1 [0233.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\6465736b746f70.ini")) returned 0 [0233.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\6465736b746f70.ini")) returned 0x20 [0233.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x325098 [0233.876] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0233.876] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0233.877] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0233.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0xffffffff [0233.877] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0233.877] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0233.878] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="Startup", cAlternateFileName="")) returned 0 [0233.878] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0233.878] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0233.878] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0233.878] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0233.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0233.878] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 1 [0233.878] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 0 [0233.879] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0233.883] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 1 [0233.883] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0233.884] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 1 [0233.884] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 1 [0233.884] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0233.884] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.884] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0233.885] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af1c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0233.885] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0233.885] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af1c) returned 0x10ab [0233.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0233.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\5472616E73636F64656457616C6C7061706572.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\5472616e73636f64656457616c6c7061706572.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0233.886] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9cfab [0233.886] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0233.886] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0233.976] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9cfab, lpOverlapped=0x0) returned 1 [0233.990] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9cfb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x9cfb0, lpOverlapped=0x0) returned 1 [0234.002] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.024] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.034] CloseHandle (hObject=0x10c) returned 1 [0234.034] CloseHandle (hObject=0x108) returned 1 [0234.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\5472616E73636F64656457616C6C7061706572.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\5472616e73636f64656457616c6c7061706572.jpg")) returned 0 [0234.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\5472616E73636F64656457616C6C7061706572.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\5472616e73636f64656457616c6c7061706572.jpg")) returned 0x2020 [0234.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0x325018 [0234.036] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0234.036] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0234.036] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 1 [0234.042] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 0xffffffff [0234.042] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0234.042] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0234.042] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 0 [0234.042] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0234.042] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Word", cAlternateFileName="")) returned 1 [0234.042] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0234.050] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0234.050] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0234.050] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0234.051] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0234.051] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 0 [0234.051] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0234.051] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0234.051] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0234.051] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Word", cAlternateFileName="")) returned 0 [0234.051] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0234.051] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0234.051] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0234.052] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="..", cAlternateFileName="")) returned 1 [0234.052] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0234.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0234.053] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0234.053] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 0 [0234.053] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0234.053] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Firefox", cAlternateFileName="")) returned 1 [0234.053] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0234.054] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0234.054] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0234.054] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0234.056] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0234.056] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 1 [0234.057] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.057] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.057] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.057] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29850, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.057] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.057] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29850) returned 0x10ab [0234.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0234.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\496E7374616C6C54696D653230313331303235313531333332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\496e7374616c6c54696d653230313331303235313531333332"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0234.059] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa [0234.059] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0234.059] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0234.147] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xa, lpOverlapped=0x0) returned 1 [0234.149] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x10, lpOverlapped=0x0) returned 1 [0234.149] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.172] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.183] CloseHandle (hObject=0x108) returned 1 [0234.183] CloseHandle (hObject=0x10c) returned 1 [0234.183] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\496E7374616C6C54696D653230313331303235313531333332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\496e7374616c6c54696d653230313331303235313531333332")) returned 0 [0234.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\496E7374616C6C54696D653230313331303235313531333332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\496e7374616c6c54696d653230313331303235313531333332")) returned 0x2020 [0234.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 0x325018 [0234.184] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 0 [0234.184] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0234.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332")) returned 1 [0234.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332")) returned 0xffffffff [0234.185] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 0 [0234.185] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0234.185] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33313032, dwReserved1=0x35323031, cFileName="Profiles", cAlternateFileName="")) returned 1 [0234.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0234.186] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="..", cAlternateFileName="")) returned 1 [0234.186] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0234.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc00ca, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325018 [0234.188] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc00ca, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0234.189] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xcc00ca, dwReserved1=0x31c7f8, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1 [0234.190] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.190] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.190] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.190] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29cf4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.190] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.190] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29cf4) returned 0x10ab [0234.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0234.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6164646F6E73.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6164646f6e73.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0234.192] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0234.192] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0234.192] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0234.284] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x18, lpOverlapped=0x0) returned 1 [0234.285] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x20, lpOverlapped=0x0) returned 1 [0234.286] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.309] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.320] CloseHandle (hObject=0x108) returned 1 [0234.320] CloseHandle (hObject=0x100) returned 1 [0234.320] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6164646F6E73.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6164646f6e73.json")) returned 0 [0234.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6164646F6E73.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6164646f6e73.json")) returned 0x2020 [0234.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 0x325058 [0234.321] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 0 [0234.321] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0234.322] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json")) returned 1 [0234.322] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json")) returned 0xffffffff [0234.322] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1 [0234.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc800c6, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325058 [0234.325] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc800c6, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0234.325] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0xc800c6, dwReserved1=0x31c7f8, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 1 [0234.325] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.326] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.326] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a1f8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.326] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a1f8) returned 0x10ab [0234.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0234.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\626F6F6B6D61726B732D323031372D30362D30355F35.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\626f6f6b6d61726b732d323031372d30362d30355f35.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0234.327] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbdb [0234.327] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0234.327] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0234.419] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0xbdb, lpOverlapped=0x0) returned 1 [0234.422] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xbe0, lpOverlapped=0x0) returned 1 [0234.423] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.446] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.457] CloseHandle (hObject=0x108) returned 1 [0234.457] CloseHandle (hObject=0x104) returned 1 [0234.457] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\626F6F6B6D61726B732D323031372D30362D30355F35.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\626f6f6b6d61726b732d323031372d30362d30355f35.json")) returned 0 [0234.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\626F6F6B6D61726B732D323031372D30362D30355F35.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\626f6f6b6d61726b732d323031372d30362d30355f35.json")) returned 0x2020 [0234.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 0x325098 [0234.458] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 0 [0234.458] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0234.458] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json")) returned 1 [0234.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json")) returned 0xffffffff [0234.459] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 1 [0234.461] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.461] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a794, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.461] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.461] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a794) returned 0x10ab [0234.461] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0234.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\626F6F6B6D61726B732D323031372D30362D31365F35.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\626f6f6b6d61726b732d323031372d30362d31365f35.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0234.463] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbdb [0234.463] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0234.463] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0234.545] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0xbdb, lpOverlapped=0x0) returned 1 [0234.556] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0xbe0, lpOverlapped=0x0) returned 1 [0234.560] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.583] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.614] CloseHandle (hObject=0x104) returned 1 [0234.614] CloseHandle (hObject=0x108) returned 1 [0234.617] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\626F6F6B6D61726B732D323031372D30362D31365F35.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\626f6f6b6d61726b732d323031372d30362d31365f35.json")) returned 0 [0234.618] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\626F6F6B6D61726B732D323031372D30362D31365F35.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\626f6f6b6d61726b732d323031372d30362d31365f35.json")) returned 0x2020 [0234.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 0x325098 [0234.618] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 0 [0234.618] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0234.618] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json")) returned 1 [0234.619] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json")) returned 0xffffffff [0234.619] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x7735387a, dwReserved1=0x7758bd6b, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 0 [0234.620] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0234.620] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2d373130, dwReserved1=0x312d3630, cFileName="cert8.db", cAlternateFileName="")) returned 1 [0234.623] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.623] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.625] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.625] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.625] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.626] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab9c) returned 0x10ab [0234.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0234.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6365727438.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6365727438.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0234.628] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0234.628] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0234.629] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0234.717] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x10000, lpOverlapped=0x0) returned 1 [0234.722] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x10010, lpOverlapped=0x0) returned 1 [0234.723] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.746] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.757] CloseHandle (hObject=0x100) returned 1 [0234.757] CloseHandle (hObject=0x108) returned 1 [0234.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6365727438.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6365727438.db")) returned 0 [0234.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6365727438.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6365727438.db")) returned 0x2020 [0234.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cert8.db", cAlternateFileName="")) returned 0x325058 [0234.758] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cert8.db", cAlternateFileName="")) returned 0 [0234.759] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0234.759] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db")) returned 1 [0234.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db")) returned 0xffffffff [0234.760] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1 [0234.761] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.761] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.761] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.761] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0234.761] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af68, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.761] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.761] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af68) returned 0x10ab [0234.761] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0234.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0234.762] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\636F6D7061746962696C697479.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\636f6d7061746962696c697479.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0234.762] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0234.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0234.763] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0234.851] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xce, lpOverlapped=0x0) returned 1 [0234.852] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xd0, lpOverlapped=0x0) returned 1 [0234.853] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.875] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.886] CloseHandle (hObject=0x108) returned 1 [0234.886] CloseHandle (hObject=0x100) returned 1 [0234.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\636F6D7061746962696C697479.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\636f6d7061746962696c697479.ini")) returned 0 [0234.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\636F6D7061746962696C697479.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\636f6d7061746962696c697479.ini")) returned 0x2020 [0234.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 0x325058 [0234.888] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 0 [0234.888] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0234.888] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini")) returned 1 [0234.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini")) returned 0xffffffff [0234.889] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5e8ce50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5e8ce50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb639bd10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1 [0234.889] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.889] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.889] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.889] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0234.890] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b094, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.890] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.890] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b094) returned 0x10ab [0234.890] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0234.890] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5ad4bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5ad4bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1 [0234.890] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.890] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.891] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0234.891] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b094, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b094) returned 0x10ab [0234.891] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0234.891] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc374ed0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc374ed0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbc555e20, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="downloads.sqlite", cAlternateFileName="DOWNLO~1.SQL")) returned 1 [0234.892] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.892] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0234.892] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b094, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b094) returned 0x10ab [0234.892] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0234.892] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 1 [0234.893] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0234.893] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.893] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0234.893] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0234.893] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b094, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0234.893] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0234.893] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b094) returned 0x10ab [0234.893] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0234.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0234.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\657874656E73696F6E73.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\657874656e73696f6e73.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0234.895] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d [0234.895] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0234.895] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0234.984] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8d, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x8d, lpOverlapped=0x0) returned 1 [0234.985] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x90, lpOverlapped=0x0) returned 1 [0234.986] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.009] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.019] CloseHandle (hObject=0x100) returned 1 [0235.020] CloseHandle (hObject=0x108) returned 1 [0235.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\657874656E73696F6E73.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\657874656e73696f6e73.ini")) returned 0 [0235.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\657874656E73696F6E73.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\657874656e73696f6e73.ini")) returned 0x2020 [0235.021] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 0x325058 [0235.021] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 0 [0235.021] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.021] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini")) returned 1 [0235.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini")) returned 0xffffffff [0235.022] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b0fa30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x70000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="extensions.sqlite", cAlternateFileName="EXTENS~1.SQL")) returned 1 [0235.023] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.023] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.023] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.023] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0235.023] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.023] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.023] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0235.024] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0235.024] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="indexedDB", cAlternateFileName="INDEXE~1")) returned 1 [0235.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName=".", cAlternateFileName="")) returned 0x325058 [0235.029] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="..", cAlternateFileName="")) returned 1 [0235.029] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1 [0235.030] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x325098 [0235.030] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0235.030] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0235.030] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.030] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.030] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.030] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0235.031] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0235.031] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0235.031] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="idb", cAlternateFileName="")) returned 1 [0235.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e26c, dwReserved1=0x18e26c, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0235.033] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e26c, dwReserved1=0x18e26c, cFileName="..", cAlternateFileName="")) returned 1 [0235.033] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e26c, dwReserved1=0x18e26c, cFileName="818200132aebmoouht", cAlternateFileName="818200~1")) returned 1 [0235.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName=".", cAlternateFileName="")) returned 0x325118 [0235.035] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName="..", cAlternateFileName="")) returned 1 [0235.035] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName="..", cAlternateFileName="")) returned 0 [0235.035] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0235.035] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x18e26c, dwReserved1=0x18e26c, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1 [0235.035] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.035] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.035] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.036] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0235.036] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aff4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.036] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.036] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aff4) returned 0x10ab [0235.036] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0235.036] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x18e26c, dwReserved1=0x18e26c, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 0 [0235.036] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0235.036] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="idb", cAlternateFileName="")) returned 0 [0235.036] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0235.036] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0 [0235.036] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.036] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="key3.db", cAlternateFileName="")) returned 1 [0235.037] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.037] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.037] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.037] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0235.037] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.037] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.037] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0235.038] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0235.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0235.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6B657933.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6b657933.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0235.039] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0235.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0235.039] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0235.115] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x4000, lpOverlapped=0x0) returned 1 [0235.116] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x4010, lpOverlapped=0x0) returned 1 [0235.118] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.140] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.151] CloseHandle (hObject=0x108) returned 1 [0235.151] CloseHandle (hObject=0x100) returned 1 [0235.152] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6B657933.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6b657933.db")) returned 0 [0235.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6B657933.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6b657933.db")) returned 0x2020 [0235.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="key3.db", cAlternateFileName="")) returned 0x325058 [0235.153] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="key3.db", cAlternateFileName="")) returned 0 [0235.153] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.153] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db")) returned 1 [0235.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db")) returned 0xffffffff [0235.154] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x850d63f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x850d63f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x850d63f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x501, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="localstore.rdf", cAlternateFileName="LOCALS~1.RDF")) returned 1 [0235.155] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.155] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d84) returned 0x10ab [0235.155] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 1 [0235.155] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.155] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29e50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.155] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.155] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29e50) returned 0x10ab [0235.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0235.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6D6172696F6E65747465.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6d6172696f6e65747465.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0235.157] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39 [0235.157] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0235.157] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0235.246] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x39, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x39, lpOverlapped=0x0) returned 1 [0235.247] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x40, lpOverlapped=0x0) returned 1 [0235.248] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.270] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.281] CloseHandle (hObject=0x100) returned 1 [0235.282] CloseHandle (hObject=0x108) returned 1 [0235.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6D6172696F6E65747465.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6d6172696f6e65747465.log")) returned 0 [0235.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\6D6172696F6E65747465.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\6d6172696f6e65747465.log")) returned 0x2020 [0235.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 0x325058 [0235.283] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 0 [0235.283] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log")) returned 1 [0235.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log")) returned 0xffffffff [0235.284] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb50b6e70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5175550, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb5175550, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xef3, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="mimeTypes.rdf", cAlternateFileName="MIMETY~1.RDF")) returned 1 [0235.285] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.285] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.285] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.285] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a274, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.285] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.285] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a274) returned 0x10ab [0235.285] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1 [0235.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName=".", cAlternateFileName="")) returned 0x325058 [0235.287] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="..", cAlternateFileName="")) returned 1 [0235.287] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e73c, dwReserved1=0x18e73c, cFileName="..", cAlternateFileName="")) returned 0 [0235.287] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.287] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1 [0235.287] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.288] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2f0) returned 0x10ab [0235.288] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb43eb830, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb43eb830, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3b3f6e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1 [0235.288] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.288] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a3c0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a3c0) returned 0x10ab [0235.288] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4c1a3d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4c1a3d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x82b58970, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa00000, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1 [0235.289] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.289] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a4a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a4a4) returned 0x10ab [0235.289] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1 [0235.289] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.289] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.289] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.289] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a584, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.290] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.290] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a584) returned 0x10ab [0235.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0235.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\706C7567696E726567.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\706c7567696e726567.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0235.291] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe14 [0235.291] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0235.291] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0235.402] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xe14, lpOverlapped=0x0) returned 1 [0235.404] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xe20, lpOverlapped=0x0) returned 1 [0235.405] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.428] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.438] CloseHandle (hObject=0x108) returned 1 [0235.438] CloseHandle (hObject=0x100) returned 1 [0235.439] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\706C7567696E726567.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\706c7567696e726567.dat")) returned 0 [0235.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\706C7567696E726567.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\706c7567696e726567.dat")) returned 0x2020 [0235.440] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 0x325058 [0235.440] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 0 [0235.440] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.440] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat")) returned 1 [0235.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat")) returned 0xffffffff [0235.441] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="prefs.js", cAlternateFileName="")) returned 1 [0235.442] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.442] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.442] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.442] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a99c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.442] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.442] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a99c) returned 0x10ab [0235.442] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0235.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\7072656673.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\7072656673.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0235.444] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfde [0235.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0235.444] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0235.523] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfde, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xfde, lpOverlapped=0x0) returned 1 [0235.524] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xfe0, lpOverlapped=0x0) returned 1 [0235.525] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.547] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.558] CloseHandle (hObject=0x100) returned 1 [0235.558] CloseHandle (hObject=0x108) returned 1 [0235.558] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\7072656673.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\7072656673.js")) returned 0 [0235.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\7072656673.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\7072656673.js")) returned 0x2020 [0235.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="prefs.js", cAlternateFileName="")) returned 0x325058 [0235.559] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="prefs.js", cAlternateFileName="")) returned 0 [0235.559] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.559] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js")) returned 1 [0235.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js")) returned 0xffffffff [0235.560] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 1 [0235.560] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.560] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.560] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.561] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad70, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.561] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.561] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad70) returned 0x10ab [0235.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0235.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\736561726368.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\736561726368.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0235.562] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4183 [0235.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0235.563] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0235.719] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4183, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x4183, lpOverlapped=0x0) returned 1 [0235.721] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4190, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x4190, lpOverlapped=0x0) returned 1 [0235.722] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.745] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.757] CloseHandle (hObject=0x108) returned 1 [0235.757] CloseHandle (hObject=0x100) returned 1 [0235.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\736561726368.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\736561726368.json")) returned 0 [0235.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\736561726368.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\736561726368.json")) returned 0x2020 [0235.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 0x325058 [0235.758] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 0 [0235.758] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.759] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json")) returned 1 [0235.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json")) returned 0xffffffff [0235.760] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="secmod.db", cAlternateFileName="")) returned 1 [0235.760] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.760] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.760] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.760] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0235.761] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b054, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.761] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.761] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b054) returned 0x10ab [0235.761] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0235.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0235.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\7365636D6F64.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\7365636d6f64.db"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0235.764] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0235.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0235.764] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0235.850] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x4000, lpOverlapped=0x0) returned 1 [0235.852] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x4010, lpOverlapped=0x0) returned 1 [0235.853] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.875] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.886] CloseHandle (hObject=0x100) returned 1 [0235.886] CloseHandle (hObject=0x108) returned 1 [0235.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\7365636D6F64.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\7365636d6f64.db")) returned 0 [0235.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\7365636D6F64.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\7365636d6f64.db")) returned 0x2020 [0235.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="secmod.db", cAlternateFileName="")) returned 0x325058 [0235.888] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="secmod.db", cAlternateFileName="")) returned 0 [0235.888] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0235.888] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db")) returned 1 [0235.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db")) returned 0xffffffff [0235.889] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 1 [0235.889] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0235.889] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.889] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0235.889] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0235.889] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2affc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0235.889] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0235.889] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2affc) returned 0x10ab [0235.890] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0235.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0235.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\73657373696F6E73746F7265.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\73657373696f6e73746f7265.bak"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0235.891] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d6 [0235.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0235.892] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0235.992] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x3d6, lpOverlapped=0x0) returned 1 [0235.993] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x3e0, lpOverlapped=0x0) returned 1 [0235.994] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.017] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.028] CloseHandle (hObject=0x108) returned 1 [0236.028] CloseHandle (hObject=0x100) returned 1 [0236.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\73657373696F6E73746F7265.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\73657373696f6e73746f7265.bak")) returned 0 [0236.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\73657373696F6E73746F7265.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\73657373696f6e73746f7265.bak")) returned 0x2020 [0236.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 0x325058 [0236.029] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 0 [0236.029] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0236.030] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak")) returned 1 [0236.030] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak")) returned 0xffffffff [0236.030] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1 [0236.031] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.031] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0236.032] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.032] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.032] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0236.032] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0236.032] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0236.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\73657373696F6E73746F7265.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\73657373696f6e73746f7265.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0236.034] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc5 [0236.034] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0236.035] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0236.106] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbc5, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xbc5, lpOverlapped=0x0) returned 1 [0236.108] WriteFile (in: hFile=0x108, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xbd0, lpOverlapped=0x0) returned 1 [0236.109] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.131] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.144] CloseHandle (hObject=0x100) returned 1 [0236.144] CloseHandle (hObject=0x108) returned 1 [0236.145] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\73657373696F6E73746F7265.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\73657373696f6e73746f7265.js")) returned 0 [0236.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\73657373696F6E73746F7265.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\73657373696f6e73746f7265.js")) returned 0x2020 [0236.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 0x325058 [0236.147] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 0 [0236.147] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0236.147] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js")) returned 1 [0236.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js")) returned 0xffffffff [0236.148] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6f36850, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x50000, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="signons.sqlite", cAlternateFileName="SIGNON~1.SQL")) returned 1 [0236.149] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.149] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0236.149] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b4) returned 0x10ab [0236.150] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0236.150] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x18e838, dwReserved1=0x18e854, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1 [0236.150] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.150] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.150] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.150] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0236.151] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b4) returned 0x10ab [0236.151] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0236.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0236.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\74696D6573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\74696d6573.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0236.153] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d [0236.153] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0236.153] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0236.253] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x1d, lpOverlapped=0x0) returned 1 [0236.254] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x20, lpOverlapped=0x0) returned 1 [0236.260] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.282] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.294] CloseHandle (hObject=0x108) returned 1 [0236.294] CloseHandle (hObject=0x100) returned 1 [0236.294] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\74696D6573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\74696d6573.json")) returned 0 [0236.295] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\74696D6573.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\74696d6573.json")) returned 0x2020 [0236.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 0x325058 [0236.295] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 0 [0236.295] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0236.295] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json")) returned 1 [0236.296] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json")) returned 0xffffffff [0236.296] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="webapps", cAlternateFileName="")) returned 1 [0236.296] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName=".", cAlternateFileName="")) returned 0x325058 [0236.297] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName="..", cAlternateFileName="")) returned 1 [0236.297] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 1 [0236.298] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.298] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.298] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.298] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0236.298] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afd4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.298] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.298] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afd4) returned 0x10ab [0236.298] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0236.299] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0236.299] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\77656261707073.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\77656261707073.json"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0236.300] GetFileSize (in: hFile=0x108, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2 [0236.300] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0236.300] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0236.402] ReadFile (in: hFile=0x108, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e698*=0x2, lpOverlapped=0x0) returned 1 [0236.402] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e698*=0x10, lpOverlapped=0x0) returned 1 [0236.403] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.425] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.437] CloseHandle (hObject=0x108) returned 1 [0236.437] CloseHandle (hObject=0x104) returned 1 [0236.438] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\77656261707073.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\77656261707073.json")) returned 0 [0236.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\77656261707073.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\77656261707073.json")) returned 0x2020 [0236.439] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0x325098 [0236.439] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0 [0236.439] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0236.439] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json")) returned 1 [0236.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json")) returned 0xffffffff [0236.440] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0xc600c4, dwReserved1=0x31c7f8, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0 [0236.440] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0236.440] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x7735386e, dwReserved1=0x7758b2c3, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1 [0236.441] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.441] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.441] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.441] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0236.441] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b084, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.441] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.441] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b084) returned 0x10ab [0236.441] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0236.441] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x7735386e, dwReserved1=0x7758b2c3, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 0 [0236.442] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0236.442] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0236.442] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0236.442] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x6c756166, dwReserved1=0x35323074, cFileName="profiles.ini", cAlternateFileName="")) returned 1 [0236.442] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.442] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.442] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.442] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0236.442] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b084, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.442] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.443] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b084) returned 0x10ab [0236.443] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0236.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0236.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\70726F66696C6573.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\70726f66696c6573.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0236.444] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0236.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0236.444] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0236.522] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x6f, lpOverlapped=0x0) returned 1 [0236.523] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x70, lpOverlapped=0x0) returned 1 [0236.524] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.546] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.557] CloseHandle (hObject=0xf4) returned 1 [0236.557] CloseHandle (hObject=0x10c) returned 1 [0236.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\70726F66696C6573.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\70726f66696c6573.ini")) returned 0 [0236.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\70726F66696C6573.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\70726f66696c6573.ini")) returned 0x2020 [0236.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="profiles.ini", cAlternateFileName="")) returned 0x324fd8 [0236.558] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="profiles.ini", cAlternateFileName="")) returned 0 [0236.558] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0236.558] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 1 [0236.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 0xffffffff [0236.559] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x6c756166, dwReserved1=0x35323074, cFileName="profiles.ini", cAlternateFileName="")) returned 0 [0236.559] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0236.559] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Firefox", cAlternateFileName="")) returned 0 [0236.559] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0236.559] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca04d8b0, ftCreationTime.dwHighDateTime=0x1d5b6ec, ftLastAccessTime.dwLowDateTime=0x7cb55d40, ftLastAccessTime.dwHighDateTime=0x1d5c25f, ftLastWriteTime.dwLowDateTime=0x7cb55d40, ftLastWriteTime.dwHighDateTime=0x1d5c25f, nFileSizeHigh=0x0, nFileSizeLow=0x1f9a, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="oBv56a2wksCLlrn.swf", cAlternateFileName="OBV56A~1.SWF")) returned 1 [0236.560] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.560] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.560] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.560] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0236.560] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.560] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.560] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a4) returned 0x10ab [0236.560] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0236.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oBv56a2wksCLlrn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\obv56a2wkscllrn.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0236.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6F427635366132776B73434C6C726E.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6f427635366132776b73434c6c726e.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0236.562] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f9a [0236.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0236.563] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0236.668] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f9a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x1f9a, lpOverlapped=0x0) returned 1 [0236.669] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1fa0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x1fa0, lpOverlapped=0x0) returned 1 [0236.670] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.692] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.703] CloseHandle (hObject=0xfc) returned 1 [0236.703] CloseHandle (hObject=0xf8) returned 1 [0236.703] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oBv56a2wksCLlrn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\obv56a2wkscllrn.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6F427635366132776B73434C6C726E.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6f427635366132776b73434c6c726e.swf")) returned 0 [0236.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6F427635366132776B73434C6C726E.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6f427635366132776b73434c6c726e.swf")) returned 0x2020 [0236.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oBv56a2wksCLlrn.swf", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca04d8b0, ftCreationTime.dwHighDateTime=0x1d5b6ec, ftLastAccessTime.dwLowDateTime=0x7cb55d40, ftLastAccessTime.dwHighDateTime=0x1d5c25f, ftLastWriteTime.dwLowDateTime=0x7cb55d40, ftLastWriteTime.dwHighDateTime=0x1d5c25f, nFileSizeHigh=0x0, nFileSizeLow=0x1f9a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="oBv56a2wksCLlrn.swf", cAlternateFileName="OBV56A~1.SWF")) returned 0x324f58 [0236.704] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca04d8b0, ftCreationTime.dwHighDateTime=0x1d5b6ec, ftLastAccessTime.dwLowDateTime=0x7cb55d40, ftLastAccessTime.dwHighDateTime=0x1d5c25f, ftLastWriteTime.dwLowDateTime=0x7cb55d40, ftLastWriteTime.dwHighDateTime=0x1d5c25f, nFileSizeHigh=0x0, nFileSizeLow=0x1f9a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="oBv56a2wksCLlrn.swf", cAlternateFileName="OBV56A~1.SWF")) returned 0 [0236.704] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0236.704] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oBv56a2wksCLlrn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\obv56a2wkscllrn.swf")) returned 1 [0236.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oBv56a2wksCLlrn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\obv56a2wkscllrn.swf")) returned 0xffffffff [0236.705] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf860f650, ftCreationTime.dwHighDateTime=0x1d5c2de, ftLastAccessTime.dwLowDateTime=0xef49d6f0, ftLastAccessTime.dwHighDateTime=0x1d5b68f, ftLastWriteTime.dwLowDateTime=0xef49d6f0, ftLastWriteTime.dwHighDateTime=0x1d5b68f, nFileSizeHigh=0x0, nFileSizeLow=0x2df9, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="OjFWEA4bBuMgBT.jpg", cAlternateFileName="OJFWEA~1.JPG")) returned 1 [0236.706] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.706] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.706] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.706] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a0b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.706] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.706] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a0b4) returned 0x10ab [0236.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OjFWEA4bBuMgBT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ojfwea4bbumgbt.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0236.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4F6A46574541346242754D674254.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4f6a46574541346242754d674254.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0236.708] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2df9 [0236.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0236.708] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0236.795] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2df9, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x2df9, lpOverlapped=0x0) returned 1 [0236.796] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x2e00, lpOverlapped=0x0) returned 1 [0236.797] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.820] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.830] CloseHandle (hObject=0xf8) returned 1 [0236.830] CloseHandle (hObject=0xfc) returned 1 [0236.831] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OjFWEA4bBuMgBT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ojfwea4bbumgbt.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4F6A46574541346242754D674254.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4f6a46574541346242754d674254.jpg")) returned 0 [0236.832] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4F6A46574541346242754D674254.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4f6a46574541346242754d674254.jpg")) returned 0x2020 [0236.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OjFWEA4bBuMgBT.jpg", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf860f650, ftCreationTime.dwHighDateTime=0x1d5c2de, ftLastAccessTime.dwLowDateTime=0xef49d6f0, ftLastAccessTime.dwHighDateTime=0x1d5b68f, ftLastWriteTime.dwLowDateTime=0xef49d6f0, ftLastWriteTime.dwHighDateTime=0x1d5b68f, nFileSizeHigh=0x0, nFileSizeLow=0x2df9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="OjFWEA4bBuMgBT.jpg", cAlternateFileName="OJFWEA~1.JPG")) returned 0x324f58 [0236.832] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf860f650, ftCreationTime.dwHighDateTime=0x1d5c2de, ftLastAccessTime.dwLowDateTime=0xef49d6f0, ftLastAccessTime.dwHighDateTime=0x1d5b68f, ftLastWriteTime.dwLowDateTime=0xef49d6f0, ftLastWriteTime.dwHighDateTime=0x1d5b68f, nFileSizeHigh=0x0, nFileSizeLow=0x2df9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="OjFWEA4bBuMgBT.jpg", cAlternateFileName="OJFWEA~1.JPG")) returned 0 [0236.832] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0236.832] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OjFWEA4bBuMgBT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ojfwea4bbumgbt.jpg")) returned 1 [0236.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OjFWEA4bBuMgBT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ojfwea4bbumgbt.jpg")) returned 0xffffffff [0236.834] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x977f830, ftCreationTime.dwHighDateTime=0x1d5bf6f, ftLastAccessTime.dwLowDateTime=0xb6091a50, ftLastAccessTime.dwHighDateTime=0x1d5b7d3, ftLastWriteTime.dwLowDateTime=0xb6091a50, ftLastWriteTime.dwHighDateTime=0x1d5b7d3, nFileSizeHigh=0x0, nFileSizeLow=0xdcea, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="pFu6CZz1vM53t7xxt.png", cAlternateFileName="PFU6CZ~1.PNG")) returned 1 [0236.834] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.834] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.835] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.835] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a434, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.835] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.835] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a434) returned 0x10ab [0236.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pFu6CZz1vM53t7xxt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pfu6czz1vm53t7xxt.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0236.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\70467536435A7A31764D35337437787874.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\70467536435a7a31764d35337437787874.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0236.836] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdcea [0236.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0236.836] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0236.926] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdcea, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xdcea, lpOverlapped=0x0) returned 1 [0236.928] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xdcf0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xdcf0, lpOverlapped=0x0) returned 1 [0236.929] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.952] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.963] CloseHandle (hObject=0xfc) returned 1 [0236.963] CloseHandle (hObject=0xf8) returned 1 [0236.964] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pFu6CZz1vM53t7xxt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pfu6czz1vm53t7xxt.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\70467536435A7A31764D35337437787874.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\70467536435a7a31764d35337437787874.png")) returned 0 [0236.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\70467536435A7A31764D35337437787874.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\70467536435a7a31764d35337437787874.png")) returned 0x2020 [0236.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pFu6CZz1vM53t7xxt.png", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x977f830, ftCreationTime.dwHighDateTime=0x1d5bf6f, ftLastAccessTime.dwLowDateTime=0xb6091a50, ftLastAccessTime.dwHighDateTime=0x1d5b7d3, ftLastWriteTime.dwLowDateTime=0xb6091a50, ftLastWriteTime.dwHighDateTime=0x1d5b7d3, nFileSizeHigh=0x0, nFileSizeLow=0xdcea, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="pFu6CZz1vM53t7xxt.png", cAlternateFileName="PFU6CZ~1.PNG")) returned 0x324f58 [0236.965] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x977f830, ftCreationTime.dwHighDateTime=0x1d5bf6f, ftLastAccessTime.dwLowDateTime=0xb6091a50, ftLastAccessTime.dwHighDateTime=0x1d5b7d3, ftLastWriteTime.dwLowDateTime=0xb6091a50, ftLastWriteTime.dwHighDateTime=0x1d5b7d3, nFileSizeHigh=0x0, nFileSizeLow=0xdcea, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="pFu6CZz1vM53t7xxt.png", cAlternateFileName="PFU6CZ~1.PNG")) returned 0 [0236.965] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0236.965] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pFu6CZz1vM53t7xxt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pfu6czz1vm53t7xxt.png")) returned 1 [0236.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pFu6CZz1vM53t7xxt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pfu6czz1vm53t7xxt.png")) returned 0xffffffff [0236.966] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x160053c0, ftCreationTime.dwHighDateTime=0x1d5b729, ftLastAccessTime.dwLowDateTime=0xc74df450, ftLastAccessTime.dwHighDateTime=0x1d5c509, ftLastWriteTime.dwLowDateTime=0xc74df450, ftLastWriteTime.dwHighDateTime=0x1d5c509, nFileSizeHigh=0x0, nFileSizeLow=0xd9c6, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Qw7E4hhQ.ppt", cAlternateFileName="")) returned 1 [0236.967] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0236.967] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.967] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0236.967] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a768, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0236.967] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0236.967] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a768) returned 0x10ab [0236.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qw7E4hhQ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qw7e4hhq.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0236.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5177374534686851.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5177374534686851.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0236.968] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9c6 [0236.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0236.968] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0237.044] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd9c6, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xd9c6, lpOverlapped=0x0) returned 1 [0237.046] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xd9d0, lpOverlapped=0x0) returned 1 [0237.047] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.072] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.083] CloseHandle (hObject=0xf8) returned 1 [0237.083] CloseHandle (hObject=0xfc) returned 1 [0237.083] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qw7E4hhQ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qw7e4hhq.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5177374534686851.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5177374534686851.ppt")) returned 0 [0237.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5177374534686851.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5177374534686851.ppt")) returned 0x2020 [0237.084] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qw7E4hhQ.ppt", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x160053c0, ftCreationTime.dwHighDateTime=0x1d5b729, ftLastAccessTime.dwLowDateTime=0xc74df450, ftLastAccessTime.dwHighDateTime=0x1d5c509, ftLastWriteTime.dwLowDateTime=0xc74df450, ftLastWriteTime.dwHighDateTime=0x1d5c509, nFileSizeHigh=0x0, nFileSizeLow=0xd9c6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Qw7E4hhQ.ppt", cAlternateFileName="")) returned 0x324f58 [0237.084] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x160053c0, ftCreationTime.dwHighDateTime=0x1d5b729, ftLastAccessTime.dwLowDateTime=0xc74df450, ftLastAccessTime.dwHighDateTime=0x1d5c509, ftLastWriteTime.dwLowDateTime=0xc74df450, ftLastWriteTime.dwHighDateTime=0x1d5c509, nFileSizeHigh=0x0, nFileSizeLow=0xd9c6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Qw7E4hhQ.ppt", cAlternateFileName="")) returned 0 [0237.084] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0237.084] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qw7E4hhQ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qw7e4hhq.ppt")) returned 1 [0237.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qw7E4hhQ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qw7e4hhq.ppt")) returned 0xffffffff [0237.086] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b5a7ea0, ftCreationTime.dwHighDateTime=0x1d5b8dd, ftLastAccessTime.dwLowDateTime=0x1d34a6f0, ftLastAccessTime.dwHighDateTime=0x1d5c408, ftLastWriteTime.dwLowDateTime=0x1d34a6f0, ftLastWriteTime.dwHighDateTime=0x1d5c408, nFileSizeHigh=0x0, nFileSizeLow=0x16b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ryJa.mp3", cAlternateFileName="")) returned 1 [0237.087] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.087] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.087] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.087] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c294cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.087] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.087] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c294cc) returned 0x10ab [0237.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ryJa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ryja.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0237.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\72794A61.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\72794a61.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0237.088] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b88 [0237.088] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0237.088] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0237.186] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16b88, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x16b88, lpOverlapped=0x0) returned 1 [0237.189] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x16b90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x16b90, lpOverlapped=0x0) returned 1 [0237.193] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.222] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.236] CloseHandle (hObject=0xfc) returned 1 [0237.236] CloseHandle (hObject=0xf8) returned 1 [0237.237] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ryJa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ryja.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\72794A61.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\72794a61.mp3")) returned 0 [0237.239] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\72794A61.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\72794a61.mp3")) returned 0x2020 [0237.239] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ryJa.mp3", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b5a7ea0, ftCreationTime.dwHighDateTime=0x1d5b8dd, ftLastAccessTime.dwLowDateTime=0x1d34a6f0, ftLastAccessTime.dwHighDateTime=0x1d5c408, ftLastWriteTime.dwLowDateTime=0x1d34a6f0, ftLastWriteTime.dwHighDateTime=0x1d5c408, nFileSizeHigh=0x0, nFileSizeLow=0x16b88, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ryJa.mp3", cAlternateFileName="")) returned 0x324f58 [0237.239] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b5a7ea0, ftCreationTime.dwHighDateTime=0x1d5b8dd, ftLastAccessTime.dwLowDateTime=0x1d34a6f0, ftLastAccessTime.dwHighDateTime=0x1d5c408, ftLastWriteTime.dwLowDateTime=0x1d34a6f0, ftLastWriteTime.dwHighDateTime=0x1d5c408, nFileSizeHigh=0x0, nFileSizeLow=0x16b88, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ryJa.mp3", cAlternateFileName="")) returned 0 [0237.239] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0237.239] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ryJa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ryja.mp3")) returned 1 [0237.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ryJa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ryja.mp3")) returned 0xffffffff [0237.241] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6f91810, ftCreationTime.dwHighDateTime=0x1d5b7ff, ftLastAccessTime.dwLowDateTime=0x6be58b30, ftLastAccessTime.dwHighDateTime=0x1d5b7a5, ftLastWriteTime.dwLowDateTime=0x6be58b30, ftLastWriteTime.dwHighDateTime=0x1d5b7a5, nFileSizeHigh=0x0, nFileSizeLow=0x14193, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="vKZTT4.gif", cAlternateFileName="")) returned 1 [0237.242] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.243] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.243] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.243] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c297a0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.243] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.243] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c297a0) returned 0x10ab [0237.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vKZTT4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vkztt4.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0237.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\764B5A545434.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\764b5a545434.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0237.245] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14193 [0237.245] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0237.245] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0237.338] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14193, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x14193, lpOverlapped=0x0) returned 1 [0237.340] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x141a0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x141a0, lpOverlapped=0x0) returned 1 [0237.342] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.365] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.376] CloseHandle (hObject=0xf8) returned 1 [0237.376] CloseHandle (hObject=0xfc) returned 1 [0237.377] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vKZTT4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vkztt4.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\764B5A545434.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\764b5a545434.gif")) returned 0 [0237.389] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\764B5A545434.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\764b5a545434.gif")) returned 0x2020 [0237.389] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vKZTT4.gif", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6f91810, ftCreationTime.dwHighDateTime=0x1d5b7ff, ftLastAccessTime.dwLowDateTime=0x6be58b30, ftLastAccessTime.dwHighDateTime=0x1d5b7a5, ftLastWriteTime.dwLowDateTime=0x6be58b30, ftLastWriteTime.dwHighDateTime=0x1d5b7a5, nFileSizeHigh=0x0, nFileSizeLow=0x14193, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="vKZTT4.gif", cAlternateFileName="")) returned 0x324f58 [0237.389] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6f91810, ftCreationTime.dwHighDateTime=0x1d5b7ff, ftLastAccessTime.dwLowDateTime=0x6be58b30, ftLastAccessTime.dwHighDateTime=0x1d5b7a5, ftLastWriteTime.dwLowDateTime=0x6be58b30, ftLastWriteTime.dwHighDateTime=0x1d5b7a5, nFileSizeHigh=0x0, nFileSizeLow=0x14193, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="vKZTT4.gif", cAlternateFileName="")) returned 0 [0237.389] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0237.389] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vKZTT4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vkztt4.gif")) returned 1 [0237.391] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vKZTT4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vkztt4.gif")) returned 0xffffffff [0237.391] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4283a70, ftCreationTime.dwHighDateTime=0x1d5ba6d, ftLastAccessTime.dwLowDateTime=0x2c346440, ftLastAccessTime.dwHighDateTime=0x1d5bcf8, ftLastWriteTime.dwLowDateTime=0x2c346440, ftLastWriteTime.dwHighDateTime=0x1d5bcf8, nFileSizeHigh=0x0, nFileSizeLow=0xc133, dwReserved0=0x0, dwReserved1=0x0, cFileName="W wJ.mkv", cAlternateFileName="WWJ~1.MKV")) returned 1 [0237.392] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.392] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.392] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.392] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29a44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.392] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.392] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29a44) returned 0x10ab [0237.392] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W wJ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w wj.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0237.392] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5720774A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5720774a.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0237.393] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc133 [0237.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0237.394] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0237.472] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc133, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xc133, lpOverlapped=0x0) returned 1 [0237.474] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc140, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xc140, lpOverlapped=0x0) returned 1 [0237.475] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.498] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.509] CloseHandle (hObject=0xfc) returned 1 [0237.509] CloseHandle (hObject=0xf8) returned 1 [0237.509] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W wJ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w wj.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5720774A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5720774a.mkv")) returned 0 [0237.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5720774A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5720774a.mkv")) returned 0x2020 [0237.510] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W wJ.mkv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4283a70, ftCreationTime.dwHighDateTime=0x1d5ba6d, ftLastAccessTime.dwLowDateTime=0x2c346440, ftLastAccessTime.dwHighDateTime=0x1d5bcf8, ftLastWriteTime.dwLowDateTime=0x2c346440, ftLastWriteTime.dwHighDateTime=0x1d5bcf8, nFileSizeHigh=0x0, nFileSizeLow=0xc133, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="W wJ.mkv", cAlternateFileName="WWJ~1.MKV")) returned 0x324f58 [0237.510] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4283a70, ftCreationTime.dwHighDateTime=0x1d5ba6d, ftLastAccessTime.dwLowDateTime=0x2c346440, ftLastAccessTime.dwHighDateTime=0x1d5bcf8, ftLastWriteTime.dwLowDateTime=0x2c346440, ftLastWriteTime.dwHighDateTime=0x1d5bcf8, nFileSizeHigh=0x0, nFileSizeLow=0xc133, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="W wJ.mkv", cAlternateFileName="WWJ~1.MKV")) returned 0 [0237.510] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0237.510] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W wJ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w wj.mkv")) returned 1 [0237.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W wJ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w wj.mkv")) returned 0xffffffff [0237.512] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7971b40, ftCreationTime.dwHighDateTime=0x1d5c459, ftLastAccessTime.dwLowDateTime=0xb909f960, ftLastAccessTime.dwHighDateTime=0x1d5bdd5, ftLastWriteTime.dwLowDateTime=0xb909f960, ftLastWriteTime.dwHighDateTime=0x1d5bdd5, nFileSizeHigh=0x0, nFileSizeLow=0x5587, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="WUZXH.mp4", cAlternateFileName="")) returned 1 [0237.513] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.513] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.513] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.513] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.513] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.513] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d28) returned 0x10ab [0237.513] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc693580, ftCreationTime.dwHighDateTime=0x1d5be19, ftLastAccessTime.dwLowDateTime=0xb8dd2090, ftLastAccessTime.dwHighDateTime=0x1d5b941, ftLastWriteTime.dwLowDateTime=0xb8dd2090, ftLastWriteTime.dwHighDateTime=0x1d5b941, nFileSizeHigh=0x0, nFileSizeLow=0xc1d8, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="_28mTQ5.pptx", cAlternateFileName="_28MTQ~1.PPT")) returned 1 [0237.513] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.513] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.513] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.513] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29dcc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.513] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.513] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29dcc) returned 0x10ab [0237.514] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc693580, ftCreationTime.dwHighDateTime=0x1d5be19, ftLastAccessTime.dwLowDateTime=0xb8dd2090, ftLastAccessTime.dwHighDateTime=0x1d5b941, ftLastWriteTime.dwLowDateTime=0xb8dd2090, ftLastWriteTime.dwHighDateTime=0x1d5b941, nFileSizeHigh=0x0, nFileSizeLow=0xc1d8, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="_28mTQ5.pptx", cAlternateFileName="_28MTQ~1.PPT")) returned 0 [0237.514] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0237.514] FindNextFileA (in: hFindFile=0x31c7b8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f6ff990, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f6ff990, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 0 [0237.514] FindClose (in: hFindFile=0x31c7b8 | out: hFindFile=0x31c7b8) returned 1 [0237.514] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0237.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f6ff990, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f6ff990, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="°³1")) returned 0xffffffff [0237.514] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0237.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78377478, dwReserved1=0x702e7478, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0237.515] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78377478, dwReserved1=0x702e7478, cFileName="..", cAlternateFileName="")) returned 1 [0237.515] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x78377478, dwReserved1=0x702e7478, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0237.515] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.515] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.515] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.515] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29cc0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.515] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.515] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29cc0) returned 0x10ab [0237.515] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0237.516] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.516] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d08) returned 0x10ab [0237.516] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0237.516] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.516] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.516] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29cc0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.516] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.517] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29cc0) returned 0x10ab [0237.517] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0237.517] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.517] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.517] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.517] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.517] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.517] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d08) returned 0x10ab [0237.517] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0237.518] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.518] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.518] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.518] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ca4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.518] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.518] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ca4) returned 0x10ab [0237.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0237.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0237.519] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19c [0237.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0237.519] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0237.635] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x19c, lpOverlapped=0x0) returned 1 [0237.636] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x1a0, lpOverlapped=0x0) returned 1 [0237.637] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.671] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.682] CloseHandle (hObject=0xf0) returned 1 [0237.682] CloseHandle (hObject=0xf8) returned 1 [0237.682] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\6465736b746f70.ini")) returned 0 [0237.683] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\6465736b746f70.ini")) returned 0x20 [0237.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0237.683] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0237.683] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0237.683] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini")) returned 1 [0237.684] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini")) returned 0xffffffff [0237.684] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0237.685] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.685] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.685] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.685] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0237.686] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.686] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.686] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0237.686] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0237.686] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0237.686] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.686] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.687] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.687] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0237.687] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f54, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.687] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.687] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f54) returned 0x10ab [0237.687] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0237.687] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0237.687] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0237.687] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0237.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="sikvnb huvuib.contact", cAlternateFileName="°³1")) returned 0xffffffff [0237.688] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9172020, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0xa9172020, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0237.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9172020, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0xa9172020, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0237.688] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9172020, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0xa9172020, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="..", cAlternateFileName="")) returned 1 [0237.688] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95420f10, ftCreationTime.dwHighDateTime=0x1d5beff, ftLastAccessTime.dwLowDateTime=0x434ac890, ftLastAccessTime.dwHighDateTime=0x1d5b70d, ftLastWriteTime.dwLowDateTime=0x434ac890, ftLastWriteTime.dwHighDateTime=0x1d5b70d, nFileSizeHigh=0x0, nFileSizeLow=0x13e18, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="2bRj0vbpKkMdZ6t68.flv", cAlternateFileName="2BRJ0V~1.FLV")) returned 1 [0237.688] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.688] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.688] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.688] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0237.689] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0237.689] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0237.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2bRj0vbpKkMdZ6t68.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2brj0vbpkkmdz6t68.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0237.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3262526A307662704B6B4D645A36743638.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3262526a307662704b6b4d645a36743638.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0237.691] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e18 [0237.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0237.691] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0237.780] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13e18, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x13e18, lpOverlapped=0x0) returned 1 [0237.782] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x13e20, lpOverlapped=0x0) returned 1 [0237.784] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.809] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.820] CloseHandle (hObject=0xf8) returned 1 [0237.820] CloseHandle (hObject=0xf0) returned 1 [0237.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2bRj0vbpKkMdZ6t68.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2brj0vbpkkmdz6t68.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3262526A307662704B6B4D645A36743638.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3262526a307662704b6b4d645a36743638.flv")) returned 0 [0237.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3262526A307662704B6B4D645A36743638.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3262526a307662704b6b4d645a36743638.flv")) returned 0x20 [0237.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2bRj0vbpKkMdZ6t68.flv", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95420f10, ftCreationTime.dwHighDateTime=0x1d5beff, ftLastAccessTime.dwLowDateTime=0x434ac890, ftLastAccessTime.dwHighDateTime=0x1d5b70d, ftLastWriteTime.dwLowDateTime=0x434ac890, ftLastWriteTime.dwHighDateTime=0x1d5b70d, nFileSizeHigh=0x0, nFileSizeLow=0x13e18, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2bRj0vbpKkMdZ6t68.flv", cAlternateFileName="2BRJ0V~1.FLV")) returned 0x324f58 [0237.821] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95420f10, ftCreationTime.dwHighDateTime=0x1d5beff, ftLastAccessTime.dwLowDateTime=0x434ac890, ftLastAccessTime.dwHighDateTime=0x1d5b70d, ftLastWriteTime.dwLowDateTime=0x434ac890, ftLastWriteTime.dwHighDateTime=0x1d5b70d, nFileSizeHigh=0x0, nFileSizeLow=0x13e18, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="2bRj0vbpKkMdZ6t68.flv", cAlternateFileName="2BRJ0V~1.FLV")) returned 0 [0237.821] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0237.821] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2bRj0vbpKkMdZ6t68.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2brj0vbpkkmdz6t68.flv")) returned 1 [0237.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2bRj0vbpKkMdZ6t68.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2brj0vbpkkmdz6t68.flv")) returned 0xffffffff [0237.824] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29d599a0, ftCreationTime.dwHighDateTime=0x1d5c20f, ftLastAccessTime.dwLowDateTime=0xb2ed2440, ftLastAccessTime.dwHighDateTime=0x1d5c57c, ftLastWriteTime.dwLowDateTime=0xb2ed2440, ftLastWriteTime.dwHighDateTime=0x1d5c57c, nFileSizeHigh=0x0, nFileSizeLow=0x135d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6gz9gCiZIewgGDjsQB.mp4", cAlternateFileName="6GZ9GC~1.MP4")) returned 1 [0237.825] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.825] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.825] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.825] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0237.825] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.825] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.825] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0237.825] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0237.825] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceb17600, ftCreationTime.dwHighDateTime=0x1d5b94b, ftLastAccessTime.dwLowDateTime=0x97017290, ftLastAccessTime.dwHighDateTime=0x1d5be60, ftLastWriteTime.dwLowDateTime=0x97017290, ftLastWriteTime.dwHighDateTime=0x1d5be60, nFileSizeHigh=0x0, nFileSizeLow=0x114f2, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="7Az7ockjbPGK3l6ZUP.odt", cAlternateFileName="7AZ7OC~1.ODT")) returned 1 [0237.826] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.826] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.826] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.826] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0237.826] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.826] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.826] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0237.826] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0237.827] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611c7af0, ftCreationTime.dwHighDateTime=0x1d5b8dc, ftLastAccessTime.dwLowDateTime=0x61f58fa0, ftLastAccessTime.dwHighDateTime=0x1d5ba0a, ftLastWriteTime.dwLowDateTime=0x61f58fa0, ftLastWriteTime.dwHighDateTime=0x1d5ba0a, nFileSizeHigh=0x0, nFileSizeLow=0x1632c, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="7HUHIG8Yyx.wav", cAlternateFileName="7HUHIG~1.WAV")) returned 1 [0237.827] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.827] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.827] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.827] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0237.827] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.827] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.827] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0237.828] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0237.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7HUHIG8Yyx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7huhig8yyx.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0237.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\37485548494738597978.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\37485548494738597978.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0237.829] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1632c [0237.829] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0237.829] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0237.907] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1632c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1632c, lpOverlapped=0x0) returned 1 [0237.910] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x16330, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x16330, lpOverlapped=0x0) returned 1 [0237.928] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.951] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.962] CloseHandle (hObject=0xf0) returned 1 [0237.962] CloseHandle (hObject=0xf8) returned 1 [0237.963] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7HUHIG8Yyx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7huhig8yyx.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\37485548494738597978.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\37485548494738597978.wav")) returned 0 [0237.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\37485548494738597978.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\37485548494738597978.wav")) returned 0x20 [0237.964] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7HUHIG8Yyx.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611c7af0, ftCreationTime.dwHighDateTime=0x1d5b8dc, ftLastAccessTime.dwLowDateTime=0x61f58fa0, ftLastAccessTime.dwHighDateTime=0x1d5ba0a, ftLastWriteTime.dwLowDateTime=0x61f58fa0, ftLastWriteTime.dwHighDateTime=0x1d5ba0a, nFileSizeHigh=0x0, nFileSizeLow=0x1632c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7HUHIG8Yyx.wav", cAlternateFileName="7HUHIG~1.WAV")) returned 0x324f58 [0237.964] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611c7af0, ftCreationTime.dwHighDateTime=0x1d5b8dc, ftLastAccessTime.dwLowDateTime=0x61f58fa0, ftLastAccessTime.dwHighDateTime=0x1d5ba0a, ftLastWriteTime.dwLowDateTime=0x61f58fa0, ftLastWriteTime.dwHighDateTime=0x1d5ba0a, nFileSizeHigh=0x0, nFileSizeLow=0x1632c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7HUHIG8Yyx.wav", cAlternateFileName="7HUHIG~1.WAV")) returned 0 [0237.964] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0237.964] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7HUHIG8Yyx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7huhig8yyx.wav")) returned 1 [0237.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7HUHIG8Yyx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7huhig8yyx.wav")) returned 0xffffffff [0237.965] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5474eea0, ftCreationTime.dwHighDateTime=0x1d5c443, ftLastAccessTime.dwLowDateTime=0x3ad64e0, ftLastAccessTime.dwHighDateTime=0x1d5b6c7, ftLastWriteTime.dwLowDateTime=0x3ad64e0, ftLastWriteTime.dwHighDateTime=0x1d5b6c7, nFileSizeHigh=0x0, nFileSizeLow=0x32e6, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="a8JXVwZYXDr--f.bmp", cAlternateFileName="A8JXVW~1.BMP")) returned 1 [0237.966] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0237.966] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.966] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0237.966] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0237.966] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fd0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0237.966] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0237.966] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fd0) returned 0x10ab [0237.967] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0237.967] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0237.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a8JXVwZYXDr--f.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a8jxvwzyxdr--f.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0237.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\61384A5856775A595844722D2D66.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\61384a5856775a595844722d2d66.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0237.968] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32e6 [0237.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0237.968] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0238.041] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x32e6, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x32e6, lpOverlapped=0x0) returned 1 [0238.042] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x32f0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x32f0, lpOverlapped=0x0) returned 1 [0238.047] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.069] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.081] CloseHandle (hObject=0xf8) returned 1 [0238.081] CloseHandle (hObject=0xf0) returned 1 [0238.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a8JXVwZYXDr--f.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a8jxvwzyxdr--f.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\61384A5856775A595844722D2D66.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\61384a5856775a595844722d2d66.bmp")) returned 0 [0238.082] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\61384A5856775A595844722D2D66.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\61384a5856775a595844722d2d66.bmp")) returned 0x20 [0238.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a8JXVwZYXDr--f.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5474eea0, ftCreationTime.dwHighDateTime=0x1d5c443, ftLastAccessTime.dwLowDateTime=0x3ad64e0, ftLastAccessTime.dwHighDateTime=0x1d5b6c7, ftLastWriteTime.dwLowDateTime=0x3ad64e0, ftLastWriteTime.dwHighDateTime=0x1d5b6c7, nFileSizeHigh=0x0, nFileSizeLow=0x32e6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="a8JXVwZYXDr--f.bmp", cAlternateFileName="A8JXVW~1.BMP")) returned 0x324f58 [0238.083] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5474eea0, ftCreationTime.dwHighDateTime=0x1d5c443, ftLastAccessTime.dwLowDateTime=0x3ad64e0, ftLastAccessTime.dwHighDateTime=0x1d5b6c7, ftLastWriteTime.dwLowDateTime=0x3ad64e0, ftLastWriteTime.dwHighDateTime=0x1d5b6c7, nFileSizeHigh=0x0, nFileSizeLow=0x32e6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="a8JXVwZYXDr--f.bmp", cAlternateFileName="A8JXVW~1.BMP")) returned 0 [0238.083] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0238.083] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a8JXVwZYXDr--f.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a8jxvwzyxdr--f.bmp")) returned 1 [0238.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a8JXVwZYXDr--f.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a8jxvwzyxdr--f.bmp")) returned 0xffffffff [0238.084] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0238.085] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0238.085] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.085] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0238.085] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c281e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0238.085] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.085] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c281e8) returned 0x10ab [0238.085] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0238.085] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0238.086] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0238.086] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0238.087] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0238.180] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x11a, lpOverlapped=0x0) returned 1 [0238.181] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x120, lpOverlapped=0x0) returned 1 [0238.181] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.203] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.214] CloseHandle (hObject=0xf0) returned 1 [0238.214] CloseHandle (hObject=0xf8) returned 1 [0238.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6465736b746f70.ini")) returned 0 [0238.215] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6465736b746f70.ini")) returned 0x20 [0238.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0238.216] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0238.216] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0238.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini")) returned 1 [0238.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini")) returned 0xffffffff [0238.217] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf319aad0, ftCreationTime.dwHighDateTime=0x1d5b667, ftLastAccessTime.dwLowDateTime=0x1ab30140, ftLastAccessTime.dwHighDateTime=0x1d5bb59, ftLastWriteTime.dwLowDateTime=0x1ab30140, ftLastWriteTime.dwHighDateTime=0x1d5bb59, nFileSizeHigh=0x0, nFileSizeLow=0x162e8, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="eiY9yHOaf.jpg", cAlternateFileName="EIY9YH~1.JPG")) returned 1 [0238.217] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0238.217] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.217] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0238.217] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c284b4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0238.217] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.217] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c284b4) returned 0x10ab [0238.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eiY9yHOaf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eiy9yhoaf.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0238.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6569593979484F6166.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6569593979484f6166.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0238.219] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x162e8 [0238.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0238.219] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0238.306] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x162e8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x162e8, lpOverlapped=0x0) returned 1 [0238.309] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x162f0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x162f0, lpOverlapped=0x0) returned 1 [0238.311] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.333] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.345] CloseHandle (hObject=0xf8) returned 1 [0238.345] CloseHandle (hObject=0xf0) returned 1 [0238.345] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eiY9yHOaf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eiy9yhoaf.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6569593979484F6166.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6569593979484f6166.jpg")) returned 0 [0238.346] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6569593979484F6166.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6569593979484f6166.jpg")) returned 0x20 [0238.346] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eiY9yHOaf.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf319aad0, ftCreationTime.dwHighDateTime=0x1d5b667, ftLastAccessTime.dwLowDateTime=0x1ab30140, ftLastAccessTime.dwHighDateTime=0x1d5bb59, ftLastWriteTime.dwLowDateTime=0x1ab30140, ftLastWriteTime.dwHighDateTime=0x1d5bb59, nFileSizeHigh=0x0, nFileSizeLow=0x162e8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="eiY9yHOaf.jpg", cAlternateFileName="EIY9YH~1.JPG")) returned 0x324f58 [0238.346] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf319aad0, ftCreationTime.dwHighDateTime=0x1d5b667, ftLastAccessTime.dwLowDateTime=0x1ab30140, ftLastAccessTime.dwHighDateTime=0x1d5bb59, ftLastWriteTime.dwLowDateTime=0x1ab30140, ftLastWriteTime.dwHighDateTime=0x1d5bb59, nFileSizeHigh=0x0, nFileSizeLow=0x162e8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="eiY9yHOaf.jpg", cAlternateFileName="EIY9YH~1.JPG")) returned 0 [0238.346] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0238.346] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eiY9yHOaf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eiy9yhoaf.jpg")) returned 1 [0238.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eiY9yHOaf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eiy9yhoaf.jpg")) returned 0xffffffff [0238.348] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1759760, ftCreationTime.dwHighDateTime=0x1d5bb27, ftLastAccessTime.dwLowDateTime=0x4e780d00, ftLastAccessTime.dwHighDateTime=0x1d5b743, ftLastWriteTime.dwLowDateTime=0x4e780d00, ftLastWriteTime.dwHighDateTime=0x1d5b743, nFileSizeHigh=0x0, nFileSizeLow=0xde3, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="emygU6NFdfGLAFnHYOs.avi", cAlternateFileName="EMYGU6~1.AVI")) returned 1 [0238.349] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0238.349] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.349] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0238.349] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2870c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0238.349] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.349] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2870c) returned 0x10ab [0238.349] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\emygU6NFdfGLAFnHYOs.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\emygu6nfdfglafnhyos.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0238.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\656D796755364E466466474C41466E48594F73.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\656d796755364e466466474c41466e48594f73.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0238.350] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde3 [0238.351] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0238.351] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0238.439] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde3, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xde3, lpOverlapped=0x0) returned 1 [0238.440] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xdf0, lpOverlapped=0x0) returned 1 [0238.441] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.464] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.475] CloseHandle (hObject=0xf0) returned 1 [0238.475] CloseHandle (hObject=0xf8) returned 1 [0238.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\emygU6NFdfGLAFnHYOs.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\emygu6nfdfglafnhyos.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\656D796755364E466466474C41466E48594F73.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\656d796755364e466466474c41466e48594f73.avi")) returned 0 [0238.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\656D796755364E466466474C41466E48594F73.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\656d796755364e466466474c41466e48594f73.avi")) returned 0x20 [0238.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\emygU6NFdfGLAFnHYOs.avi", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1759760, ftCreationTime.dwHighDateTime=0x1d5bb27, ftLastAccessTime.dwLowDateTime=0x4e780d00, ftLastAccessTime.dwHighDateTime=0x1d5b743, ftLastWriteTime.dwLowDateTime=0x4e780d00, ftLastWriteTime.dwHighDateTime=0x1d5b743, nFileSizeHigh=0x0, nFileSizeLow=0xde3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="emygU6NFdfGLAFnHYOs.avi", cAlternateFileName="EMYGU6~1.AVI")) returned 0x324f58 [0238.477] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1759760, ftCreationTime.dwHighDateTime=0x1d5bb27, ftLastAccessTime.dwLowDateTime=0x4e780d00, ftLastAccessTime.dwHighDateTime=0x1d5b743, ftLastWriteTime.dwLowDateTime=0x4e780d00, ftLastWriteTime.dwHighDateTime=0x1d5b743, nFileSizeHigh=0x0, nFileSizeLow=0xde3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="emygU6NFdfGLAFnHYOs.avi", cAlternateFileName="EMYGU6~1.AVI")) returned 0 [0238.477] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0238.477] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\emygU6NFdfGLAFnHYOs.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\emygu6nfdfglafnhyos.avi")) returned 1 [0238.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\emygU6NFdfGLAFnHYOs.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\emygu6nfdfglafnhyos.avi")) returned 0xffffffff [0238.478] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb551a00, ftCreationTime.dwHighDateTime=0x1d5b838, ftLastAccessTime.dwLowDateTime=0x2469ade0, ftLastAccessTime.dwHighDateTime=0x1d5bb24, ftLastWriteTime.dwLowDateTime=0x2469ade0, ftLastWriteTime.dwHighDateTime=0x1d5bb24, nFileSizeHigh=0x0, nFileSizeLow=0x674e, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="ggLcbUcMZMOp.wav", cAlternateFileName="GGLCBU~1.WAV")) returned 1 [0238.478] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0238.478] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.478] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0238.478] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28a28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0238.478] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.479] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28a28) returned 0x10ab [0238.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ggLcbUcMZMOp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gglcbucmzmop.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0238.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\67674C636255634D5A4D4F70.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\67674c636255634d5a4d4f70.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0238.480] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x674e [0238.480] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0238.480] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0238.566] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x674e, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x674e, lpOverlapped=0x0) returned 1 [0238.567] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6750, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x6750, lpOverlapped=0x0) returned 1 [0238.568] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.591] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.602] CloseHandle (hObject=0xf8) returned 1 [0238.602] CloseHandle (hObject=0xf0) returned 1 [0238.602] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ggLcbUcMZMOp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gglcbucmzmop.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\67674C636255634D5A4D4F70.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\67674c636255634d5a4d4f70.wav")) returned 0 [0238.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\67674C636255634D5A4D4F70.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\67674c636255634d5a4d4f70.wav")) returned 0x20 [0238.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ggLcbUcMZMOp.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb551a00, ftCreationTime.dwHighDateTime=0x1d5b838, ftLastAccessTime.dwLowDateTime=0x2469ade0, ftLastAccessTime.dwHighDateTime=0x1d5bb24, ftLastWriteTime.dwLowDateTime=0x2469ade0, ftLastWriteTime.dwHighDateTime=0x1d5bb24, nFileSizeHigh=0x0, nFileSizeLow=0x674e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ggLcbUcMZMOp.wav", cAlternateFileName="GGLCBU~1.WAV")) returned 0x324f58 [0238.603] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb551a00, ftCreationTime.dwHighDateTime=0x1d5b838, ftLastAccessTime.dwLowDateTime=0x2469ade0, ftLastAccessTime.dwHighDateTime=0x1d5bb24, ftLastWriteTime.dwLowDateTime=0x2469ade0, ftLastWriteTime.dwHighDateTime=0x1d5bb24, nFileSizeHigh=0x0, nFileSizeLow=0x674e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ggLcbUcMZMOp.wav", cAlternateFileName="GGLCBU~1.WAV")) returned 0 [0238.603] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0238.603] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ggLcbUcMZMOp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gglcbucmzmop.wav")) returned 1 [0238.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ggLcbUcMZMOp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gglcbucmzmop.wav")) returned 0xffffffff [0238.604] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe080c1d0, ftCreationTime.dwHighDateTime=0x1d5bd22, ftLastAccessTime.dwLowDateTime=0x4be0ea00, ftLastAccessTime.dwHighDateTime=0x1d5c57e, ftLastWriteTime.dwLowDateTime=0x4be0ea00, ftLastWriteTime.dwHighDateTime=0x1d5c57e, nFileSizeHigh=0x0, nFileSizeLow=0xd9e0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="gj9CrmcWLewwKpu.jpg", cAlternateFileName="GJ9CRM~1.JPG")) returned 1 [0238.605] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0238.605] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.605] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0238.605] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28d2c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0238.605] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.605] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28d2c) returned 0x10ab [0238.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gj9CrmcWLewwKpu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gj9crmcwlewwkpu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0238.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\676A3943726D63574C6577774B7075.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\676a3943726d63574c6577774b7075.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0238.606] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9e0 [0238.606] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0238.606] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0238.700] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd9e0, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xd9e0, lpOverlapped=0x0) returned 1 [0238.702] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd9f0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xd9f0, lpOverlapped=0x0) returned 1 [0238.703] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.726] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.737] CloseHandle (hObject=0xf0) returned 1 [0238.737] CloseHandle (hObject=0xf8) returned 1 [0238.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gj9CrmcWLewwKpu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gj9crmcwlewwkpu.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\676A3943726D63574C6577774B7075.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\676a3943726d63574c6577774b7075.jpg")) returned 0 [0238.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\676A3943726D63574C6577774B7075.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\676a3943726d63574c6577774b7075.jpg")) returned 0x20 [0238.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gj9CrmcWLewwKpu.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe080c1d0, ftCreationTime.dwHighDateTime=0x1d5bd22, ftLastAccessTime.dwLowDateTime=0x4be0ea00, ftLastAccessTime.dwHighDateTime=0x1d5c57e, ftLastWriteTime.dwLowDateTime=0x4be0ea00, ftLastWriteTime.dwHighDateTime=0x1d5c57e, nFileSizeHigh=0x0, nFileSizeLow=0xd9e0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="gj9CrmcWLewwKpu.jpg", cAlternateFileName="GJ9CRM~1.JPG")) returned 0x324f58 [0238.738] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe080c1d0, ftCreationTime.dwHighDateTime=0x1d5bd22, ftLastAccessTime.dwLowDateTime=0x4be0ea00, ftLastAccessTime.dwHighDateTime=0x1d5c57e, ftLastWriteTime.dwLowDateTime=0x4be0ea00, ftLastWriteTime.dwHighDateTime=0x1d5c57e, nFileSizeHigh=0x0, nFileSizeLow=0xd9e0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="gj9CrmcWLewwKpu.jpg", cAlternateFileName="GJ9CRM~1.JPG")) returned 0 [0238.738] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0238.738] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gj9CrmcWLewwKpu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gj9crmcwlewwkpu.jpg")) returned 1 [0238.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gj9CrmcWLewwKpu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gj9crmcwlewwkpu.jpg")) returned 0xffffffff [0238.740] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f14720, ftCreationTime.dwHighDateTime=0x1d5b7f2, ftLastAccessTime.dwLowDateTime=0x1dd48020, ftLastAccessTime.dwHighDateTime=0x1d5bec8, ftLastWriteTime.dwLowDateTime=0x1dd48020, ftLastWriteTime.dwHighDateTime=0x1d5bec8, nFileSizeHigh=0x0, nFileSizeLow=0xe66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="hQoj1QItIp.wav", cAlternateFileName="HQOJ1Q~1.WAV")) returned 1 [0238.740] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0238.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0238.740] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0238.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.741] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29018) returned 0x10ab [0238.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hQoj1QItIp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hqoj1qitip.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0238.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\68516F6A315149744970.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\68516f6a315149744970.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0238.742] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe66c [0238.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0238.742] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0238.812] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe66c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xe66c, lpOverlapped=0x0) returned 1 [0238.814] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe670, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xe670, lpOverlapped=0x0) returned 1 [0238.816] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.838] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.848] CloseHandle (hObject=0xf8) returned 1 [0238.848] CloseHandle (hObject=0xf0) returned 1 [0238.848] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hQoj1QItIp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hqoj1qitip.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\68516F6A315149744970.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\68516f6a315149744970.wav")) returned 0 [0238.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\68516F6A315149744970.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\68516f6a315149744970.wav")) returned 0x20 [0238.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hQoj1QItIp.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f14720, ftCreationTime.dwHighDateTime=0x1d5b7f2, ftLastAccessTime.dwLowDateTime=0x1dd48020, ftLastAccessTime.dwHighDateTime=0x1d5bec8, ftLastWriteTime.dwLowDateTime=0x1dd48020, ftLastWriteTime.dwHighDateTime=0x1d5bec8, nFileSizeHigh=0x0, nFileSizeLow=0xe66c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="hQoj1QItIp.wav", cAlternateFileName="HQOJ1Q~1.WAV")) returned 0x324f58 [0238.849] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f14720, ftCreationTime.dwHighDateTime=0x1d5b7f2, ftLastAccessTime.dwLowDateTime=0x1dd48020, ftLastAccessTime.dwHighDateTime=0x1d5bec8, ftLastWriteTime.dwLowDateTime=0x1dd48020, ftLastWriteTime.dwHighDateTime=0x1d5bec8, nFileSizeHigh=0x0, nFileSizeLow=0xe66c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="hQoj1QItIp.wav", cAlternateFileName="HQOJ1Q~1.WAV")) returned 0 [0238.850] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0238.850] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hQoj1QItIp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hqoj1qitip.wav")) returned 1 [0238.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hQoj1QItIp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hqoj1qitip.wav")) returned 0xffffffff [0238.851] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1505780, ftCreationTime.dwHighDateTime=0x1d5d809, ftLastAccessTime.dwLowDateTime=0xa1505780, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0x9f869400, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x1c800, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="inbox.pe.exe", cAlternateFileName="INBOXP~1.EXE")) returned 1 [0238.851] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0238.851] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.851] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0238.851] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2929c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0238.851] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.851] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2929c) returned 0x10ab [0238.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0238.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\696E626F782E7065.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\696e626f782e7065.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0238.852] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c800 [0238.852] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0238.853] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0238.941] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1c800, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1c800, lpOverlapped=0x0) returned 1 [0238.944] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1c810, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x1c810, lpOverlapped=0x0) returned 1 [0238.946] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.969] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.980] CloseHandle (hObject=0xf0) returned 1 [0238.980] CloseHandle (hObject=0xf8) returned 1 [0238.980] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\696E626F782E7065.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\696e626f782e7065.exe")) returned 0 [0238.981] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\696E626F782E7065.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\696e626f782e7065.exe")) returned 0x20 [0238.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1505780, ftCreationTime.dwHighDateTime=0x1d5d809, ftLastAccessTime.dwLowDateTime=0xa1505780, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0x9f869400, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x1c800, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="inbox.pe.exe", cAlternateFileName="INBOXP~1.EXE")) returned 0x324f58 [0238.981] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1505780, ftCreationTime.dwHighDateTime=0x1d5d809, ftLastAccessTime.dwLowDateTime=0xa1505780, ftLastAccessTime.dwHighDateTime=0x1d5d809, ftLastWriteTime.dwLowDateTime=0x9f869400, ftLastWriteTime.dwHighDateTime=0x1d5d809, nFileSizeHigh=0x0, nFileSizeLow=0x1c800, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="inbox.pe.exe", cAlternateFileName="INBOXP~1.EXE")) returned 0 [0238.981] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0238.981] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe")) returned 0 [0238.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\inbox.pe.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\inbox.pe.exe")) returned 0x20 [0238.982] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa01bb030, ftCreationTime.dwHighDateTime=0x1d5c512, ftLastAccessTime.dwLowDateTime=0xf04f5de0, ftLastAccessTime.dwHighDateTime=0x1d5bb62, ftLastWriteTime.dwLowDateTime=0xf04f5de0, ftLastWriteTime.dwHighDateTime=0x1d5bb62, nFileSizeHigh=0x0, nFileSizeLow=0x355b, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="jajw q.jpg", cAlternateFileName="JAJWQ~1.JPG")) returned 1 [0238.983] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0238.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0238.983] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2802c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0238.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0238.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2802c) returned 0x10ab [0238.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jajw q.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jajw q.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0238.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6A616A772071.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6a616a772071.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0238.984] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x355b [0238.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0238.984] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0239.072] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x355b, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x355b, lpOverlapped=0x0) returned 1 [0239.073] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x3560, lpOverlapped=0x0) returned 1 [0239.075] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.098] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.108] CloseHandle (hObject=0xf8) returned 1 [0239.108] CloseHandle (hObject=0xf0) returned 1 [0239.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jajw q.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jajw q.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6A616A772071.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6a616a772071.jpg")) returned 0 [0239.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6A616A772071.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6a616a772071.jpg")) returned 0x20 [0239.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jajw q.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa01bb030, ftCreationTime.dwHighDateTime=0x1d5c512, ftLastAccessTime.dwLowDateTime=0xf04f5de0, ftLastAccessTime.dwHighDateTime=0x1d5bb62, ftLastWriteTime.dwLowDateTime=0xf04f5de0, ftLastWriteTime.dwHighDateTime=0x1d5bb62, nFileSizeHigh=0x0, nFileSizeLow=0x355b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="jajw q.jpg", cAlternateFileName="JAJWQ~1.JPG")) returned 0x324f58 [0239.110] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa01bb030, ftCreationTime.dwHighDateTime=0x1d5c512, ftLastAccessTime.dwLowDateTime=0xf04f5de0, ftLastAccessTime.dwHighDateTime=0x1d5bb62, ftLastWriteTime.dwLowDateTime=0xf04f5de0, ftLastWriteTime.dwHighDateTime=0x1d5bb62, nFileSizeHigh=0x0, nFileSizeLow=0x355b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="jajw q.jpg", cAlternateFileName="JAJWQ~1.JPG")) returned 0 [0239.110] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0239.110] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jajw q.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jajw q.jpg")) returned 1 [0239.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jajw q.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jajw q.jpg")) returned 0xffffffff [0239.111] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24b5220, ftCreationTime.dwHighDateTime=0x1d5c4d0, ftLastAccessTime.dwLowDateTime=0x73115770, ftLastAccessTime.dwHighDateTime=0x1d5c4c7, ftLastWriteTime.dwLowDateTime=0x73115770, ftLastWriteTime.dwHighDateTime=0x1d5c4c7, nFileSizeHigh=0x0, nFileSizeLow=0xe6b, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="jORmc7hqTjAL5t.wav", cAlternateFileName="JORMC7~1.WAV")) returned 1 [0239.112] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0239.112] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0239.112] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c282d0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0239.112] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.112] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c282d0) returned 0x10ab [0239.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jORmc7hqTjAL5t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jormc7hqtjal5t.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0239.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6A4F526D63376871546A414C3574.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6a4f526d63376871546a414c3574.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.113] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6b [0239.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0239.114] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0239.218] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe6b, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xe6b, lpOverlapped=0x0) returned 1 [0239.220] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xe70, lpOverlapped=0x0) returned 1 [0239.222] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.250] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.261] CloseHandle (hObject=0xf0) returned 1 [0239.261] CloseHandle (hObject=0xf8) returned 1 [0239.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jORmc7hqTjAL5t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jormc7hqtjal5t.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6A4F526D63376871546A414C3574.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6a4f526d63376871546a414c3574.wav")) returned 0 [0239.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6A4F526D63376871546A414C3574.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6a4f526d63376871546a414c3574.wav")) returned 0x20 [0239.263] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jORmc7hqTjAL5t.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24b5220, ftCreationTime.dwHighDateTime=0x1d5c4d0, ftLastAccessTime.dwLowDateTime=0x73115770, ftLastAccessTime.dwHighDateTime=0x1d5c4c7, ftLastWriteTime.dwLowDateTime=0x73115770, ftLastWriteTime.dwHighDateTime=0x1d5c4c7, nFileSizeHigh=0x0, nFileSizeLow=0xe6b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="jORmc7hqTjAL5t.wav", cAlternateFileName="JORMC7~1.WAV")) returned 0x324f58 [0239.263] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24b5220, ftCreationTime.dwHighDateTime=0x1d5c4d0, ftLastAccessTime.dwLowDateTime=0x73115770, ftLastAccessTime.dwHighDateTime=0x1d5c4c7, ftLastWriteTime.dwLowDateTime=0x73115770, ftLastWriteTime.dwHighDateTime=0x1d5c4c7, nFileSizeHigh=0x0, nFileSizeLow=0xe6b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="jORmc7hqTjAL5t.wav", cAlternateFileName="JORMC7~1.WAV")) returned 0 [0239.263] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0239.263] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jORmc7hqTjAL5t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jormc7hqtjal5t.wav")) returned 1 [0239.264] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jORmc7hqTjAL5t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jormc7hqtjal5t.wav")) returned 0xffffffff [0239.265] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d57a550, ftCreationTime.dwHighDateTime=0x1d5b8f1, ftLastAccessTime.dwLowDateTime=0x2012f370, ftLastAccessTime.dwHighDateTime=0x1d5c1b2, ftLastWriteTime.dwLowDateTime=0x2012f370, ftLastWriteTime.dwHighDateTime=0x1d5c1b2, nFileSizeHigh=0x0, nFileSizeLow=0x45e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="qgZ1uci-rIE2 2_.docx", cAlternateFileName="QGZ1UC~1.DOC")) returned 1 [0239.266] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0239.266] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.266] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0239.266] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c285ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0239.266] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.266] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c285ec) returned 0x10ab [0239.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qgZ1uci-rIE2 2_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qgz1uci-rie2 2_.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\71675A317563692D7249453220325F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\71675a317563692d7249453220325f.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0239.268] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45e2 [0239.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0239.268] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0239.344] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x45e2, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x45e2, lpOverlapped=0x0) returned 1 [0239.345] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x45f0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x45f0, lpOverlapped=0x0) returned 1 [0239.346] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.369] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.407] CloseHandle (hObject=0xf8) returned 1 [0239.407] CloseHandle (hObject=0xf0) returned 1 [0239.407] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qgZ1uci-rIE2 2_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qgz1uci-rie2 2_.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\71675A317563692D7249453220325F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\71675a317563692d7249453220325f.docx")) returned 0 [0239.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\71675A317563692D7249453220325F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\71675a317563692d7249453220325f.docx")) returned 0x20 [0239.408] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qgZ1uci-rIE2 2_.docx", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d57a550, ftCreationTime.dwHighDateTime=0x1d5b8f1, ftLastAccessTime.dwLowDateTime=0x2012f370, ftLastAccessTime.dwHighDateTime=0x1d5c1b2, ftLastWriteTime.dwLowDateTime=0x2012f370, ftLastWriteTime.dwHighDateTime=0x1d5c1b2, nFileSizeHigh=0x0, nFileSizeLow=0x45e2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qgZ1uci-rIE2 2_.docx", cAlternateFileName="QGZ1UC~1.DOC")) returned 0x324f58 [0239.408] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d57a550, ftCreationTime.dwHighDateTime=0x1d5b8f1, ftLastAccessTime.dwLowDateTime=0x2012f370, ftLastAccessTime.dwHighDateTime=0x1d5c1b2, ftLastWriteTime.dwLowDateTime=0x2012f370, ftLastWriteTime.dwHighDateTime=0x1d5c1b2, nFileSizeHigh=0x0, nFileSizeLow=0x45e2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qgZ1uci-rIE2 2_.docx", cAlternateFileName="QGZ1UC~1.DOC")) returned 0 [0239.408] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0239.408] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qgZ1uci-rIE2 2_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qgz1uci-rie2 2_.docx")) returned 1 [0239.410] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qgZ1uci-rIE2 2_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qgz1uci-rie2 2_.docx")) returned 0xffffffff [0239.410] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870b08c0, ftCreationTime.dwHighDateTime=0x1d5c2c9, ftLastAccessTime.dwLowDateTime=0x50d18be0, ftLastAccessTime.dwHighDateTime=0x1d5b88c, ftLastWriteTime.dwLowDateTime=0x50d18be0, ftLastWriteTime.dwHighDateTime=0x1d5b88c, nFileSizeHigh=0x0, nFileSizeLow=0xe352, dwReserved0=0x0, dwReserved1=0x0, cFileName="sU9lQS.mp3", cAlternateFileName="")) returned 1 [0239.411] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0239.411] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.411] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0239.411] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28918, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0239.411] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.411] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28918) returned 0x10ab [0239.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sU9lQS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\su9lqs.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0239.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7355396C5153.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7355396c5153.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.414] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe352 [0239.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0239.415] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0239.488] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe352, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xe352, lpOverlapped=0x0) returned 1 [0239.490] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe360, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xe360, lpOverlapped=0x0) returned 1 [0239.492] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.515] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.526] CloseHandle (hObject=0xf0) returned 1 [0239.526] CloseHandle (hObject=0xf8) returned 1 [0239.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sU9lQS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\su9lqs.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7355396C5153.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7355396c5153.mp3")) returned 0 [0239.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7355396C5153.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7355396c5153.mp3")) returned 0x20 [0239.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sU9lQS.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870b08c0, ftCreationTime.dwHighDateTime=0x1d5c2c9, ftLastAccessTime.dwLowDateTime=0x50d18be0, ftLastAccessTime.dwHighDateTime=0x1d5b88c, ftLastWriteTime.dwLowDateTime=0x50d18be0, ftLastWriteTime.dwHighDateTime=0x1d5b88c, nFileSizeHigh=0x0, nFileSizeLow=0xe352, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sU9lQS.mp3", cAlternateFileName="")) returned 0x324f58 [0239.528] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870b08c0, ftCreationTime.dwHighDateTime=0x1d5c2c9, ftLastAccessTime.dwLowDateTime=0x50d18be0, ftLastAccessTime.dwHighDateTime=0x1d5b88c, ftLastWriteTime.dwLowDateTime=0x50d18be0, ftLastWriteTime.dwHighDateTime=0x1d5b88c, nFileSizeHigh=0x0, nFileSizeLow=0xe352, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sU9lQS.mp3", cAlternateFileName="")) returned 0 [0239.528] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0239.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sU9lQS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\su9lqs.mp3")) returned 1 [0239.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sU9lQS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\su9lqs.mp3")) returned 0xffffffff [0239.529] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2337150, ftCreationTime.dwHighDateTime=0x1d5c15c, ftLastAccessTime.dwLowDateTime=0x8b6529f0, ftLastAccessTime.dwHighDateTime=0x1d5be7d, ftLastWriteTime.dwLowDateTime=0x8b6529f0, ftLastWriteTime.dwHighDateTime=0x1d5be7d, nFileSizeHigh=0x0, nFileSizeLow=0x32c1, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="X 6TBFvP-nRgliUSwBhE.xls", cAlternateFileName="X6TBFV~1.XLS")) returned 1 [0239.530] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0239.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0239.530] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28b80, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0239.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28b80) returned 0x10ab [0239.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\X 6TBFvP-nRgliUSwBhE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x 6tbfvp-nrgliuswbhe.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\58203654424676502D6E52676C69555377426845.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\58203654424676502d6e52676c69555377426845.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0239.532] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32c1 [0239.532] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0239.533] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0239.659] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x32c1, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x32c1, lpOverlapped=0x0) returned 1 [0239.660] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x32d0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x32d0, lpOverlapped=0x0) returned 1 [0239.661] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.692] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.703] CloseHandle (hObject=0xf8) returned 1 [0239.703] CloseHandle (hObject=0xf0) returned 1 [0239.703] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\X 6TBFvP-nRgliUSwBhE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x 6tbfvp-nrgliuswbhe.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\58203654424676502D6E52676C69555377426845.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\58203654424676502d6e52676c69555377426845.xls")) returned 0 [0239.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\58203654424676502D6E52676C69555377426845.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\58203654424676502d6e52676c69555377426845.xls")) returned 0x20 [0239.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\X 6TBFvP-nRgliUSwBhE.xls", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2337150, ftCreationTime.dwHighDateTime=0x1d5c15c, ftLastAccessTime.dwLowDateTime=0x8b6529f0, ftLastAccessTime.dwHighDateTime=0x1d5be7d, ftLastWriteTime.dwLowDateTime=0x8b6529f0, ftLastWriteTime.dwHighDateTime=0x1d5be7d, nFileSizeHigh=0x0, nFileSizeLow=0x32c1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="X 6TBFvP-nRgliUSwBhE.xls", cAlternateFileName="X6TBFV~1.XLS")) returned 0x324f58 [0239.704] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2337150, ftCreationTime.dwHighDateTime=0x1d5c15c, ftLastAccessTime.dwLowDateTime=0x8b6529f0, ftLastAccessTime.dwHighDateTime=0x1d5be7d, ftLastWriteTime.dwLowDateTime=0x8b6529f0, ftLastWriteTime.dwHighDateTime=0x1d5be7d, nFileSizeHigh=0x0, nFileSizeLow=0x32c1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="X 6TBFvP-nRgliUSwBhE.xls", cAlternateFileName="X6TBFV~1.XLS")) returned 0 [0239.704] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0239.705] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\X 6TBFvP-nRgliUSwBhE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x 6tbfvp-nrgliuswbhe.xls")) returned 1 [0239.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\X 6TBFvP-nRgliUSwBhE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x 6tbfvp-nrgliuswbhe.xls")) returned 0xffffffff [0239.706] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0528a0, ftCreationTime.dwHighDateTime=0x1d5c0f2, ftLastAccessTime.dwLowDateTime=0xf3a2b120, ftLastAccessTime.dwHighDateTime=0x1d5bb6e, ftLastWriteTime.dwLowDateTime=0xf3a2b120, ftLastWriteTime.dwHighDateTime=0x1d5bb6e, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="xqKMH4clluwCjvHhn.mp3", cAlternateFileName="XQKMH4~1.MP3")) returned 1 [0239.707] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0239.707] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.707] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0239.707] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28ecc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0239.707] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.707] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28ecc) returned 0x10ab [0239.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xqKMH4clluwCjvHhn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xqkmh4clluwcjvhhn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0239.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\78714B4D4834636C6C7577436A7648686E.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\78714b4d4834636c6c7577436a7648686e.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.708] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e4d [0239.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0239.708] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0239.805] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e4d, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1e4d, lpOverlapped=0x0) returned 1 [0239.806] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e50, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x1e50, lpOverlapped=0x0) returned 1 [0239.807] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.829] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.840] CloseHandle (hObject=0xf0) returned 1 [0239.840] CloseHandle (hObject=0xf8) returned 1 [0239.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xqKMH4clluwCjvHhn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xqkmh4clluwcjvhhn.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\78714B4D4834636C6C7577436A7648686E.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\78714b4d4834636c6c7577436a7648686e.mp3")) returned 0 [0239.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\78714B4D4834636C6C7577436A7648686E.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\78714b4d4834636c6c7577436a7648686e.mp3")) returned 0x20 [0239.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xqKMH4clluwCjvHhn.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0528a0, ftCreationTime.dwHighDateTime=0x1d5c0f2, ftLastAccessTime.dwLowDateTime=0xf3a2b120, ftLastAccessTime.dwHighDateTime=0x1d5bb6e, ftLastWriteTime.dwLowDateTime=0xf3a2b120, ftLastWriteTime.dwHighDateTime=0x1d5bb6e, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="xqKMH4clluwCjvHhn.mp3", cAlternateFileName="XQKMH4~1.MP3")) returned 0x324f58 [0239.841] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0528a0, ftCreationTime.dwHighDateTime=0x1d5c0f2, ftLastAccessTime.dwLowDateTime=0xf3a2b120, ftLastAccessTime.dwHighDateTime=0x1d5bb6e, ftLastWriteTime.dwLowDateTime=0xf3a2b120, ftLastWriteTime.dwHighDateTime=0x1d5bb6e, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="xqKMH4clluwCjvHhn.mp3", cAlternateFileName="XQKMH4~1.MP3")) returned 0 [0239.841] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0239.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xqKMH4clluwCjvHhn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xqkmh4clluwcjvhhn.mp3")) returned 1 [0239.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xqKMH4clluwCjvHhn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xqkmh4clluwcjvhhn.mp3")) returned 0xffffffff [0239.843] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7aeafe70, ftCreationTime.dwHighDateTime=0x1d5c318, ftLastAccessTime.dwLowDateTime=0xe888b90, ftLastAccessTime.dwHighDateTime=0x1d5b656, ftLastWriteTime.dwLowDateTime=0xe888b90, ftLastWriteTime.dwHighDateTime=0x1d5b656, nFileSizeHigh=0x0, nFileSizeLow=0x12f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="y6U_i.mkv", cAlternateFileName="")) returned 1 [0239.844] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0239.844] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.844] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0239.844] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0239.844] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.844] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291ac) returned 0x10ab [0239.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y6U_i.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y6u_i.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7936555F69.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7936555f69.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0239.845] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f00 [0239.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0239.845] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0239.920] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12f00, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x12f00, lpOverlapped=0x0) returned 1 [0239.922] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12f10, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x12f10, lpOverlapped=0x0) returned 1 [0239.924] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.947] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.958] CloseHandle (hObject=0xf8) returned 1 [0239.958] CloseHandle (hObject=0xf0) returned 1 [0239.959] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y6U_i.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y6u_i.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7936555F69.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7936555f69.mkv")) returned 0 [0239.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7936555F69.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7936555f69.mkv")) returned 0x20 [0239.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y6U_i.mkv", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7aeafe70, ftCreationTime.dwHighDateTime=0x1d5c318, ftLastAccessTime.dwLowDateTime=0xe888b90, ftLastAccessTime.dwHighDateTime=0x1d5b656, ftLastWriteTime.dwLowDateTime=0xe888b90, ftLastWriteTime.dwHighDateTime=0x1d5b656, nFileSizeHigh=0x0, nFileSizeLow=0x12f00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="y6U_i.mkv", cAlternateFileName="")) returned 0x324f58 [0239.960] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7aeafe70, ftCreationTime.dwHighDateTime=0x1d5c318, ftLastAccessTime.dwLowDateTime=0xe888b90, ftLastAccessTime.dwHighDateTime=0x1d5b656, ftLastWriteTime.dwLowDateTime=0xe888b90, ftLastWriteTime.dwHighDateTime=0x1d5b656, nFileSizeHigh=0x0, nFileSizeLow=0x12f00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="y6U_i.mkv", cAlternateFileName="")) returned 0 [0239.960] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0239.960] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y6U_i.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y6u_i.mkv")) returned 1 [0239.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y6U_i.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y6u_i.mkv")) returned 0xffffffff [0239.962] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b242150, ftCreationTime.dwHighDateTime=0x1d5bed5, ftLastAccessTime.dwLowDateTime=0xa78e70b0, ftLastAccessTime.dwHighDateTime=0x1d5c142, ftLastWriteTime.dwLowDateTime=0xa78e70b0, ftLastWriteTime.dwHighDateTime=0x1d5c142, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Ynvyy2nEvZalx", cAlternateFileName="YNVYY2~1")) returned 1 [0239.962] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b242150, ftCreationTime.dwHighDateTime=0x1d5bed5, ftLastAccessTime.dwLowDateTime=0xa78e70b0, ftLastAccessTime.dwHighDateTime=0x1d5c142, ftLastWriteTime.dwLowDateTime=0xa78e70b0, ftLastWriteTime.dwHighDateTime=0x1d5c142, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60005e, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0239.962] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b242150, ftCreationTime.dwHighDateTime=0x1d5bed5, ftLastAccessTime.dwLowDateTime=0xa78e70b0, ftLastAccessTime.dwHighDateTime=0x1d5c142, ftLastWriteTime.dwLowDateTime=0xa78e70b0, ftLastWriteTime.dwHighDateTime=0x1d5c142, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60005e, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0239.962] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78e2930, ftCreationTime.dwHighDateTime=0x1d5c31c, ftLastAccessTime.dwLowDateTime=0xaf437730, ftLastAccessTime.dwHighDateTime=0x1d5c5be, ftLastWriteTime.dwLowDateTime=0xaf437730, ftLastWriteTime.dwHighDateTime=0x1d5c5be, nFileSizeHigh=0x0, nFileSizeLow=0xbade, dwReserved0=0x60005e, dwReserved1=0x31c7b8, cFileName="2eBKenikOsdWy 1aIv4.wav", cAlternateFileName="2EBKEN~1.WAV")) returned 1 [0239.963] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0239.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0239.963] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0239.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0239.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f9c) returned 0x10ab [0239.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\2eBKenikOsdWy 1aIv4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\2ebkenikosdwy 1aiv4.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\3265424B656E696B4F73645779203161497634.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\3265424b656e696b4f73645779203161497634.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0239.964] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbade [0239.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0239.965] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0240.053] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbade, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xbade, lpOverlapped=0x0) returned 1 [0240.055] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbae0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xbae0, lpOverlapped=0x0) returned 1 [0240.056] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.079] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.090] CloseHandle (hObject=0xf8) returned 1 [0240.090] CloseHandle (hObject=0xfc) returned 1 [0240.090] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\2eBKenikOsdWy 1aIv4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\2ebkenikosdwy 1aiv4.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\3265424B656E696B4F73645779203161497634.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\3265424b656e696b4f73645779203161497634.wav")) returned 0 [0240.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\3265424B656E696B4F73645779203161497634.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\3265424b656e696b4f73645779203161497634.wav")) returned 0x20 [0240.091] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\2eBKenikOsdWy 1aIv4.wav", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78e2930, ftCreationTime.dwHighDateTime=0x1d5c31c, ftLastAccessTime.dwLowDateTime=0xaf437730, ftLastAccessTime.dwHighDateTime=0x1d5c5be, ftLastWriteTime.dwLowDateTime=0xaf437730, ftLastWriteTime.dwHighDateTime=0x1d5c5be, nFileSizeHigh=0x0, nFileSizeLow=0xbade, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2eBKenikOsdWy 1aIv4.wav", cAlternateFileName="2EBKEN~1.WAV")) returned 0x324f98 [0240.091] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78e2930, ftCreationTime.dwHighDateTime=0x1d5c31c, ftLastAccessTime.dwLowDateTime=0xaf437730, ftLastAccessTime.dwHighDateTime=0x1d5c5be, ftLastWriteTime.dwLowDateTime=0xaf437730, ftLastWriteTime.dwHighDateTime=0x1d5c5be, nFileSizeHigh=0x0, nFileSizeLow=0xbade, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="2eBKenikOsdWy 1aIv4.wav", cAlternateFileName="2EBKEN~1.WAV")) returned 0 [0240.091] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0240.091] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\2eBKenikOsdWy 1aIv4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\2ebkenikosdwy 1aiv4.wav")) returned 1 [0240.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\2eBKenikOsdWy 1aIv4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\2ebkenikosdwy 1aiv4.wav")) returned 0xffffffff [0240.093] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77590c80, ftCreationTime.dwHighDateTime=0x1d5bf93, ftLastAccessTime.dwLowDateTime=0x240560a0, ftLastAccessTime.dwHighDateTime=0x1d5bb8e, ftLastWriteTime.dwLowDateTime=0x240560a0, ftLastWriteTime.dwHighDateTime=0x1d5bb8e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="CsmtSJAH1fH8LXWhLXAQ", cAlternateFileName="CSMTSJ~1")) returned 1 [0240.093] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77590c80, ftCreationTime.dwHighDateTime=0x1d5bf93, ftLastAccessTime.dwLowDateTime=0x240560a0, ftLastAccessTime.dwHighDateTime=0x1d5bb8e, ftLastWriteTime.dwLowDateTime=0x240560a0, ftLastWriteTime.dwHighDateTime=0x1d5bb8e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x980096, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0240.093] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77590c80, ftCreationTime.dwHighDateTime=0x1d5bf93, ftLastAccessTime.dwLowDateTime=0x240560a0, ftLastAccessTime.dwHighDateTime=0x1d5bb8e, ftLastWriteTime.dwLowDateTime=0x240560a0, ftLastWriteTime.dwHighDateTime=0x1d5bb8e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x980096, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0240.093] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd190880, ftCreationTime.dwHighDateTime=0x1d5c569, ftLastAccessTime.dwLowDateTime=0x775f0340, ftLastAccessTime.dwHighDateTime=0x1d5c2f1, ftLastWriteTime.dwLowDateTime=0x775f0340, ftLastWriteTime.dwHighDateTime=0x1d5c2f1, nFileSizeHigh=0x0, nFileSizeLow=0x977c, dwReserved0=0x980096, dwReserved1=0x31c7b8, cFileName="x1pxO3J-_BHTQF Q.mp3", cAlternateFileName="X1PXO3~1.MP3")) returned 1 [0240.094] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.094] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c281cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.094] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.094] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c281cc) returned 0x10ab [0240.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\x1pxO3J-_BHTQF Q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\x1pxo3j-_bhtqf q.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0240.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\783170784F334A2D5F42485451462051.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\783170784f334a2d5f42485451462051.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0240.097] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x977c [0240.097] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0240.097] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0240.188] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x977c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x977c, lpOverlapped=0x0) returned 1 [0240.189] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x9780, lpOverlapped=0x0) returned 1 [0240.191] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.214] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.225] CloseHandle (hObject=0xf8) returned 1 [0240.225] CloseHandle (hObject=0x10c) returned 1 [0240.225] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\x1pxO3J-_BHTQF Q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\x1pxo3j-_bhtqf q.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\783170784F334A2D5F42485451462051.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\783170784f334a2d5f42485451462051.mp3")) returned 0 [0240.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\783170784F334A2D5F42485451462051.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\783170784f334a2d5f42485451462051.mp3")) returned 0x20 [0240.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\x1pxO3J-_BHTQF Q.mp3", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd190880, ftCreationTime.dwHighDateTime=0x1d5c569, ftLastAccessTime.dwLowDateTime=0x775f0340, ftLastAccessTime.dwHighDateTime=0x1d5c2f1, ftLastWriteTime.dwLowDateTime=0x775f0340, ftLastWriteTime.dwHighDateTime=0x1d5c2f1, nFileSizeHigh=0x0, nFileSizeLow=0x977c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="x1pxO3J-_BHTQF Q.mp3", cAlternateFileName="X1PXO3~1.MP3")) returned 0x324fd8 [0240.227] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd190880, ftCreationTime.dwHighDateTime=0x1d5c569, ftLastAccessTime.dwLowDateTime=0x775f0340, ftLastAccessTime.dwHighDateTime=0x1d5c2f1, ftLastWriteTime.dwLowDateTime=0x775f0340, ftLastWriteTime.dwHighDateTime=0x1d5c2f1, nFileSizeHigh=0x0, nFileSizeLow=0x977c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="x1pxO3J-_BHTQF Q.mp3", cAlternateFileName="X1PXO3~1.MP3")) returned 0 [0240.227] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0240.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\x1pxO3J-_BHTQF Q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\x1pxo3j-_bhtqf q.mp3")) returned 1 [0240.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\x1pxO3J-_BHTQF Q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\x1pxo3j-_bhtqf q.mp3")) returned 0xffffffff [0240.228] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90be0c0, ftCreationTime.dwHighDateTime=0x1d5ba70, ftLastAccessTime.dwLowDateTime=0xf7c92e80, ftLastAccessTime.dwHighDateTime=0x1d5bdcd, ftLastWriteTime.dwLowDateTime=0xf7c92e80, ftLastWriteTime.dwHighDateTime=0x1d5bdcd, nFileSizeHigh=0x0, nFileSizeLow=0x16a1e, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="_mVH2kz43L.wav", cAlternateFileName="_MVH2K~1.WAV")) returned 1 [0240.229] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.229] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.229] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29724, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.229] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.229] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29724) returned 0x10ab [0240.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\_mVH2kz43L.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\_mvh2kz43l.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0240.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\5F6D5648326B7A34334C.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\5f6d5648326b7a34334c.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0240.230] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a1e [0240.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0240.230] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0240.319] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16a1e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x16a1e, lpOverlapped=0x0) returned 1 [0240.322] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x16a20, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x16a20, lpOverlapped=0x0) returned 1 [0240.326] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.349] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.368] CloseHandle (hObject=0x10c) returned 1 [0240.368] CloseHandle (hObject=0xf8) returned 1 [0240.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\_mVH2kz43L.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\_mvh2kz43l.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\5F6D5648326B7A34334C.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\5f6d5648326b7a34334c.wav")) returned 0 [0240.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\5F6D5648326B7A34334C.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\5f6d5648326b7a34334c.wav")) returned 0x20 [0240.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\_mVH2kz43L.wav", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90be0c0, ftCreationTime.dwHighDateTime=0x1d5ba70, ftLastAccessTime.dwLowDateTime=0xf7c92e80, ftLastAccessTime.dwHighDateTime=0x1d5bdcd, ftLastWriteTime.dwLowDateTime=0xf7c92e80, ftLastWriteTime.dwHighDateTime=0x1d5bdcd, nFileSizeHigh=0x0, nFileSizeLow=0x16a1e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_mVH2kz43L.wav", cAlternateFileName="_MVH2K~1.WAV")) returned 0x324fd8 [0240.370] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90be0c0, ftCreationTime.dwHighDateTime=0x1d5ba70, ftLastAccessTime.dwLowDateTime=0xf7c92e80, ftLastAccessTime.dwHighDateTime=0x1d5bdcd, ftLastWriteTime.dwLowDateTime=0xf7c92e80, ftLastWriteTime.dwHighDateTime=0x1d5bdcd, nFileSizeHigh=0x0, nFileSizeLow=0x16a1e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_mVH2kz43L.wav", cAlternateFileName="_MVH2K~1.WAV")) returned 0 [0240.370] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0240.370] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\_mVH2kz43L.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\_mvh2kz43l.wav")) returned 1 [0240.372] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\CsmtSJAH1fH8LXWhLXAQ\\_mVH2kz43L.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\csmtsjah1fh8lxwhlxaq\\_mvh2kz43l.wav")) returned 0xffffffff [0240.372] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90be0c0, ftCreationTime.dwHighDateTime=0x1d5ba70, ftLastAccessTime.dwLowDateTime=0xf7c92e80, ftLastAccessTime.dwHighDateTime=0x1d5bdcd, ftLastWriteTime.dwLowDateTime=0xf7c92e80, ftLastWriteTime.dwHighDateTime=0x1d5bdcd, nFileSizeHigh=0x0, nFileSizeLow=0x16a1e, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="_mVH2kz43L.wav", cAlternateFileName="_MVH2K~1.WAV")) returned 0 [0240.372] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0240.372] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabe5f6d0, ftCreationTime.dwHighDateTime=0x1d5c46a, ftLastAccessTime.dwLowDateTime=0xdd77c2b0, ftLastAccessTime.dwHighDateTime=0x1d5c0b3, ftLastWriteTime.dwLowDateTime=0xdd77c2b0, ftLastWriteTime.dwHighDateTime=0x1d5c0b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20766177, dwReserved1=0x706d2e51, cFileName="fLYMxN0uZ4", cAlternateFileName="FLYMXN~1")) returned 1 [0240.372] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabe5f6d0, ftCreationTime.dwHighDateTime=0x1d5c46a, ftLastAccessTime.dwLowDateTime=0xdd77c2b0, ftLastAccessTime.dwHighDateTime=0x1d5c0b3, ftLastWriteTime.dwLowDateTime=0xdd77c2b0, ftLastWriteTime.dwHighDateTime=0x1d5c0b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0240.372] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabe5f6d0, ftCreationTime.dwHighDateTime=0x1d5c46a, ftLastAccessTime.dwLowDateTime=0xdd77c2b0, ftLastAccessTime.dwHighDateTime=0x1d5c0b3, ftLastWriteTime.dwLowDateTime=0xdd77c2b0, ftLastWriteTime.dwHighDateTime=0x1d5c0b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.372] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf691afe0, ftCreationTime.dwHighDateTime=0x1d5b7ee, ftLastAccessTime.dwLowDateTime=0x5d2985e0, ftLastAccessTime.dwHighDateTime=0x1d5be6e, ftLastWriteTime.dwLowDateTime=0x5d2985e0, ftLastWriteTime.dwHighDateTime=0x1d5be6e, nFileSizeHigh=0x0, nFileSizeLow=0x71d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="1YI5ld05XHrT.flv", cAlternateFileName="1YI5LD~1.FLV")) returned 1 [0240.374] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.374] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.374] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.374] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c297d8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.374] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.374] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c297d8) returned 0x10ab [0240.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\1YI5ld05XHrT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\1yi5ld05xhrt.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0240.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\315949356C64303558487254.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\315949356c64303558487254.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0240.375] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71d2 [0240.376] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0240.376] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0240.460] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x71d2, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x71d2, lpOverlapped=0x0) returned 1 [0240.461] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x71e0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x71e0, lpOverlapped=0x0) returned 1 [0240.463] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.485] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.496] CloseHandle (hObject=0xf8) returned 1 [0240.496] CloseHandle (hObject=0x10c) returned 1 [0240.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\1YI5ld05XHrT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\1yi5ld05xhrt.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\315949356C64303558487254.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\315949356c64303558487254.flv")) returned 0 [0240.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\315949356C64303558487254.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\315949356c64303558487254.flv")) returned 0x20 [0240.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\1YI5ld05XHrT.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf691afe0, ftCreationTime.dwHighDateTime=0x1d5b7ee, ftLastAccessTime.dwLowDateTime=0x5d2985e0, ftLastAccessTime.dwHighDateTime=0x1d5be6e, ftLastWriteTime.dwLowDateTime=0x5d2985e0, ftLastWriteTime.dwHighDateTime=0x1d5be6e, nFileSizeHigh=0x0, nFileSizeLow=0x71d2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="1YI5ld05XHrT.flv", cAlternateFileName="1YI5LD~1.FLV")) returned 0x324fd8 [0240.498] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf691afe0, ftCreationTime.dwHighDateTime=0x1d5b7ee, ftLastAccessTime.dwLowDateTime=0x5d2985e0, ftLastAccessTime.dwHighDateTime=0x1d5be6e, ftLastWriteTime.dwLowDateTime=0x5d2985e0, ftLastWriteTime.dwHighDateTime=0x1d5be6e, nFileSizeHigh=0x0, nFileSizeLow=0x71d2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="1YI5ld05XHrT.flv", cAlternateFileName="1YI5LD~1.FLV")) returned 0 [0240.498] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0240.498] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\1YI5ld05XHrT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\1yi5ld05xhrt.flv")) returned 1 [0240.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\1YI5ld05XHrT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\1yi5ld05xhrt.flv")) returned 0xffffffff [0240.499] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3648c0, ftCreationTime.dwHighDateTime=0x1d5b6ac, ftLastAccessTime.dwLowDateTime=0x9b4c2110, ftLastAccessTime.dwHighDateTime=0x1d5bf0f, ftLastWriteTime.dwLowDateTime=0x9b4c2110, ftLastWriteTime.dwHighDateTime=0x1d5bf0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c9c, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="5asd3AVG1.pdf", cAlternateFileName="5ASD3A~1.PDF")) returned 1 [0240.500] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.500] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.500] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.500] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29bec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.500] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.500] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29bec) returned 0x10ab [0240.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\5asd3AVG1.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\5asd3avg1.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0240.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\356173643341564731.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\356173643341564731.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0240.501] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c9c [0240.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0240.501] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0240.598] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13c9c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x13c9c, lpOverlapped=0x0) returned 1 [0240.601] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13ca0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x13ca0, lpOverlapped=0x0) returned 1 [0240.603] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.625] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.636] CloseHandle (hObject=0x10c) returned 1 [0240.636] CloseHandle (hObject=0xf8) returned 1 [0240.636] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\5asd3AVG1.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\5asd3avg1.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\356173643341564731.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\356173643341564731.pdf")) returned 0 [0240.637] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\356173643341564731.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\356173643341564731.pdf")) returned 0x20 [0240.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\5asd3AVG1.pdf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3648c0, ftCreationTime.dwHighDateTime=0x1d5b6ac, ftLastAccessTime.dwLowDateTime=0x9b4c2110, ftLastAccessTime.dwHighDateTime=0x1d5bf0f, ftLastWriteTime.dwLowDateTime=0x9b4c2110, ftLastWriteTime.dwHighDateTime=0x1d5bf0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c9c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5asd3AVG1.pdf", cAlternateFileName="5ASD3A~1.PDF")) returned 0x324fd8 [0240.637] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3648c0, ftCreationTime.dwHighDateTime=0x1d5b6ac, ftLastAccessTime.dwLowDateTime=0x9b4c2110, ftLastAccessTime.dwHighDateTime=0x1d5bf0f, ftLastWriteTime.dwLowDateTime=0x9b4c2110, ftLastWriteTime.dwHighDateTime=0x1d5bf0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c9c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5asd3AVG1.pdf", cAlternateFileName="5ASD3A~1.PDF")) returned 0 [0240.637] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0240.637] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\5asd3AVG1.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\5asd3avg1.pdf")) returned 1 [0240.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\5asd3AVG1.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\5asd3avg1.pdf")) returned 0xffffffff [0240.639] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39c14c80, ftCreationTime.dwHighDateTime=0x1d5b63c, ftLastAccessTime.dwLowDateTime=0x765b060, ftLastAccessTime.dwHighDateTime=0x1d5bdb6, ftLastWriteTime.dwLowDateTime=0x765b060, ftLastWriteTime.dwHighDateTime=0x1d5bdb6, nFileSizeHigh=0x0, nFileSizeLow=0x3437, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="7GqmO5rhL8u9kc5ml-.jpg", cAlternateFileName="7GQMO5~1.JPG")) returned 1 [0240.640] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.640] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d0c) returned 0x10ab [0240.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\7GqmO5rhL8u9kc5ml-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\7gqmo5rhl8u9kc5ml-.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0240.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\3747716D4F3572684C3875396B63356D6C2D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\3747716d4f3572684c3875396b63356d6c2d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0240.641] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3437 [0240.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0240.641] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0240.725] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3437, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x3437, lpOverlapped=0x0) returned 1 [0240.726] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3440, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x3440, lpOverlapped=0x0) returned 1 [0240.727] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.750] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.760] CloseHandle (hObject=0xf8) returned 1 [0240.760] CloseHandle (hObject=0x10c) returned 1 [0240.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\7GqmO5rhL8u9kc5ml-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\7gqmo5rhl8u9kc5ml-.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\3747716D4F3572684C3875396B63356D6C2D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\3747716d4f3572684c3875396b63356d6c2d.jpg")) returned 0 [0240.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\3747716D4F3572684C3875396B63356D6C2D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\3747716d4f3572684c3875396b63356d6c2d.jpg")) returned 0x20 [0240.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\7GqmO5rhL8u9kc5ml-.jpg", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39c14c80, ftCreationTime.dwHighDateTime=0x1d5b63c, ftLastAccessTime.dwLowDateTime=0x765b060, ftLastAccessTime.dwHighDateTime=0x1d5bdb6, ftLastWriteTime.dwLowDateTime=0x765b060, ftLastWriteTime.dwHighDateTime=0x1d5bdb6, nFileSizeHigh=0x0, nFileSizeLow=0x3437, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7GqmO5rhL8u9kc5ml-.jpg", cAlternateFileName="7GQMO5~1.JPG")) returned 0x324fd8 [0240.761] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39c14c80, ftCreationTime.dwHighDateTime=0x1d5b63c, ftLastAccessTime.dwLowDateTime=0x765b060, ftLastAccessTime.dwHighDateTime=0x1d5bdb6, ftLastWriteTime.dwLowDateTime=0x765b060, ftLastWriteTime.dwHighDateTime=0x1d5bdb6, nFileSizeHigh=0x0, nFileSizeLow=0x3437, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7GqmO5rhL8u9kc5ml-.jpg", cAlternateFileName="7GQMO5~1.JPG")) returned 0 [0240.761] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0240.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\7GqmO5rhL8u9kc5ml-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\7gqmo5rhl8u9kc5ml-.jpg")) returned 1 [0240.763] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\7GqmO5rhL8u9kc5ml-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\7gqmo5rhl8u9kc5ml-.jpg")) returned 0xffffffff [0240.763] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35436b20, ftCreationTime.dwHighDateTime=0x1d5bd03, ftLastAccessTime.dwLowDateTime=0x96a030b0, ftLastAccessTime.dwHighDateTime=0x1d5c4ab, ftLastWriteTime.dwLowDateTime=0x96a030b0, ftLastWriteTime.dwHighDateTime=0x1d5c4ab, nFileSizeHigh=0x0, nFileSizeLow=0xfb62, dwReserved0=0x0, dwReserved1=0x0, cFileName="lo0kQrF7bS38tNSof3.mp4", cAlternateFileName="LO0KQR~1.MP4")) returned 1 [0240.763] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.763] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.763] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a09c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.763] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.763] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a09c) returned 0x10ab [0240.764] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e2cae0, ftCreationTime.dwHighDateTime=0x1d5baf7, ftLastAccessTime.dwLowDateTime=0x238c8df0, ftLastAccessTime.dwHighDateTime=0x1d5c4e0, ftLastWriteTime.dwLowDateTime=0x238c8df0, ftLastWriteTime.dwHighDateTime=0x1d5c4e0, nFileSizeHigh=0x0, nFileSizeLow=0x128f6, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="VgnXuf9D1z1wDHz0Dfz1.gif", cAlternateFileName="VGNXUF~1.GIF")) returned 1 [0240.764] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.764] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.764] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.764] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a120, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.764] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.764] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a120) returned 0x10ab [0240.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\VgnXuf9D1z1wDHz0Dfz1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\vgnxuf9d1z1wdhz0dfz1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0240.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\56676E5875663944317A317744487A3044667A31.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\56676e5875663944317a317744487a3044667a31.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0240.765] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x128f6 [0240.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0240.765] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0240.851] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x128f6, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x128f6, lpOverlapped=0x0) returned 1 [0240.853] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12900, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x12900, lpOverlapped=0x0) returned 1 [0240.855] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.877] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.887] CloseHandle (hObject=0x10c) returned 1 [0240.888] CloseHandle (hObject=0xf8) returned 1 [0240.888] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\VgnXuf9D1z1wDHz0Dfz1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\vgnxuf9d1z1wdhz0dfz1.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\56676E5875663944317A317744487A3044667A31.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\56676e5875663944317a317744487a3044667a31.gif")) returned 0 [0240.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\56676E5875663944317A317744487A3044667A31.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\56676e5875663944317a317744487a3044667a31.gif")) returned 0x20 [0240.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\VgnXuf9D1z1wDHz0Dfz1.gif", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e2cae0, ftCreationTime.dwHighDateTime=0x1d5baf7, ftLastAccessTime.dwLowDateTime=0x238c8df0, ftLastAccessTime.dwHighDateTime=0x1d5c4e0, ftLastWriteTime.dwLowDateTime=0x238c8df0, ftLastWriteTime.dwHighDateTime=0x1d5c4e0, nFileSizeHigh=0x0, nFileSizeLow=0x128f6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="VgnXuf9D1z1wDHz0Dfz1.gif", cAlternateFileName="VGNXUF~1.GIF")) returned 0x324fd8 [0240.889] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e2cae0, ftCreationTime.dwHighDateTime=0x1d5baf7, ftLastAccessTime.dwLowDateTime=0x238c8df0, ftLastAccessTime.dwHighDateTime=0x1d5c4e0, ftLastWriteTime.dwLowDateTime=0x238c8df0, ftLastWriteTime.dwHighDateTime=0x1d5c4e0, nFileSizeHigh=0x0, nFileSizeLow=0x128f6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="VgnXuf9D1z1wDHz0Dfz1.gif", cAlternateFileName="VGNXUF~1.GIF")) returned 0 [0240.889] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0240.889] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\VgnXuf9D1z1wDHz0Dfz1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\vgnxuf9d1z1wdhz0dfz1.gif")) returned 1 [0240.890] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\fLYMxN0uZ4\\VgnXuf9D1z1wDHz0Dfz1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\flymxn0uz4\\vgnxuf9d1z1wdhz0dfz1.gif")) returned 0xffffffff [0240.890] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48687a20, ftCreationTime.dwHighDateTime=0x1d5c162, ftLastAccessTime.dwLowDateTime=0x3713cde0, ftLastAccessTime.dwHighDateTime=0x1d5bccd, ftLastWriteTime.dwLowDateTime=0x3713cde0, ftLastWriteTime.dwHighDateTime=0x1d5bccd, nFileSizeHigh=0x0, nFileSizeLow=0x165a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="XvRz-VY.mp4", cAlternateFileName="")) returned 1 [0240.891] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.891] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a510, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.891] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.891] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a510) returned 0x10ab [0240.891] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48687a20, ftCreationTime.dwHighDateTime=0x1d5c162, ftLastAccessTime.dwLowDateTime=0x3713cde0, ftLastAccessTime.dwHighDateTime=0x1d5bccd, ftLastWriteTime.dwLowDateTime=0x3713cde0, ftLastWriteTime.dwHighDateTime=0x1d5bccd, nFileSizeHigh=0x0, nFileSizeLow=0x165a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="XvRz-VY.mp4", cAlternateFileName="")) returned 0 [0240.891] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0240.891] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414435b0, ftCreationTime.dwHighDateTime=0x1d5bb98, ftLastAccessTime.dwLowDateTime=0x360911c0, ftLastAccessTime.dwHighDateTime=0x1d5c2b9, ftLastWriteTime.dwLowDateTime=0x360911c0, ftLastWriteTime.dwHighDateTime=0x1d5c2b9, nFileSizeHigh=0x0, nFileSizeLow=0x16545, dwReserved0=0x7a484477, dwReserved1=0x7a664430, cFileName="K55pt55pFueNvTNy-f.m4a", cAlternateFileName="K55PT5~1.M4A")) returned 1 [0240.891] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.892] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a480, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a480) returned 0x10ab [0240.892] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f953d50, ftCreationTime.dwHighDateTime=0x1d5bf54, ftLastAccessTime.dwLowDateTime=0x563cb730, ftLastAccessTime.dwHighDateTime=0x1d5b98b, ftLastWriteTime.dwLowDateTime=0x563cb730, ftLastWriteTime.dwHighDateTime=0x1d5b98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="UN6XF0CnxZ", cAlternateFileName="UN6XF0~1")) returned 1 [0240.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f953d50, ftCreationTime.dwHighDateTime=0x1d5bf54, ftLastAccessTime.dwLowDateTime=0x563cb730, ftLastAccessTime.dwHighDateTime=0x1d5b98b, ftLastWriteTime.dwLowDateTime=0x563cb730, ftLastWriteTime.dwHighDateTime=0x1d5b98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0240.892] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f953d50, ftCreationTime.dwHighDateTime=0x1d5bf54, ftLastAccessTime.dwLowDateTime=0x563cb730, ftLastAccessTime.dwHighDateTime=0x1d5b98b, ftLastWriteTime.dwLowDateTime=0x563cb730, ftLastWriteTime.dwHighDateTime=0x1d5b98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 1 [0240.892] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19af3b10, ftCreationTime.dwHighDateTime=0x1d5c126, ftLastAccessTime.dwLowDateTime=0x388e1880, ftLastAccessTime.dwHighDateTime=0x1d5b901, ftLastWriteTime.dwLowDateTime=0x388e1880, ftLastWriteTime.dwHighDateTime=0x1d5b901, nFileSizeHigh=0x0, nFileSizeLow=0x5825, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="9hkrVTe8c9ClXfMGARQ.mp4", cAlternateFileName="9HKRVT~1.MP4")) returned 1 [0240.892] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.892] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.892] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.892] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.893] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.893] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f9c) returned 0x10ab [0240.893] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x372abc20, ftCreationTime.dwHighDateTime=0x1d5b689, ftLastAccessTime.dwLowDateTime=0x6e3b7840, ftLastAccessTime.dwHighDateTime=0x1d5b949, ftLastWriteTime.dwLowDateTime=0x6e3b7840, ftLastWriteTime.dwHighDateTime=0x1d5b949, nFileSizeHigh=0x0, nFileSizeLow=0x8920, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="cmq4h5VsxHVX0ebM.m4a", cAlternateFileName="CMQ4H5~1.M4A")) returned 1 [0240.893] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.893] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.893] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.893] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a4fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.893] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.893] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a4fc) returned 0x10ab [0240.893] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf60f1f80, ftCreationTime.dwHighDateTime=0x1d5b5d7, ftLastAccessTime.dwLowDateTime=0x461a8030, ftLastAccessTime.dwHighDateTime=0x1d5c11a, ftLastWriteTime.dwLowDateTime=0x461a8030, ftLastWriteTime.dwHighDateTime=0x1d5c11a, nFileSizeHigh=0x0, nFileSizeLow=0x45d9, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="E5JOoW2CWdnVJ.doc", cAlternateFileName="E5JOOW~1.DOC")) returned 1 [0240.894] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0240.894] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.894] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0240.894] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0240.894] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0240.894] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f9c) returned 0x10ab [0240.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\E5JOoW2CWdnVJ.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\e5joow2cwdnvj.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0240.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\45354A4F6F57324357646E564A.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\45354a4f6f57324357646e564a.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0240.895] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45d9 [0240.895] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0240.895] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0240.989] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x45d9, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x45d9, lpOverlapped=0x0) returned 1 [0240.990] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x45e0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x45e0, lpOverlapped=0x0) returned 1 [0240.993] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.016] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.029] CloseHandle (hObject=0xf8) returned 1 [0241.029] CloseHandle (hObject=0x10c) returned 1 [0241.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\E5JOoW2CWdnVJ.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\e5joow2cwdnvj.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\45354A4F6F57324357646E564A.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\45354a4f6f57324357646e564a.doc")) returned 0 [0241.033] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\45354A4F6F57324357646E564A.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\45354a4f6f57324357646e564a.doc")) returned 0x20 [0241.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\E5JOoW2CWdnVJ.doc", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf60f1f80, ftCreationTime.dwHighDateTime=0x1d5b5d7, ftLastAccessTime.dwLowDateTime=0x461a8030, ftLastAccessTime.dwHighDateTime=0x1d5c11a, ftLastWriteTime.dwLowDateTime=0x461a8030, ftLastWriteTime.dwHighDateTime=0x1d5c11a, nFileSizeHigh=0x0, nFileSizeLow=0x45d9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="E5JOoW2CWdnVJ.doc", cAlternateFileName="E5JOOW~1.DOC")) returned 0x324fd8 [0241.033] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf60f1f80, ftCreationTime.dwHighDateTime=0x1d5b5d7, ftLastAccessTime.dwLowDateTime=0x461a8030, ftLastAccessTime.dwHighDateTime=0x1d5c11a, ftLastWriteTime.dwLowDateTime=0x461a8030, ftLastWriteTime.dwHighDateTime=0x1d5c11a, nFileSizeHigh=0x0, nFileSizeLow=0x45d9, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="E5JOoW2CWdnVJ.doc", cAlternateFileName="E5JOOW~1.DOC")) returned 0 [0241.033] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0241.033] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\E5JOoW2CWdnVJ.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\e5joow2cwdnvj.doc")) returned 1 [0241.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\E5JOoW2CWdnVJ.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\e5joow2cwdnvj.doc")) returned 0xffffffff [0241.035] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf626f710, ftCreationTime.dwHighDateTime=0x1d5ba26, ftLastAccessTime.dwLowDateTime=0xae9b9f30, ftLastAccessTime.dwHighDateTime=0x1d5c3e1, ftLastWriteTime.dwLowDateTime=0xae9b9f30, ftLastWriteTime.dwHighDateTime=0x1d5c3e1, nFileSizeHigh=0x0, nFileSizeLow=0x1176c, dwReserved0=0x0, dwReserved1=0x0, cFileName="L50JZ2YINIpc_oEnbW-.png", cAlternateFileName="L50JZ2~1.PNG")) returned 1 [0241.038] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.038] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.040] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.040] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c293cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.040] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.040] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c293cc) returned 0x10ab [0241.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\L50JZ2YINIpc_oEnbW-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\l50jz2yinipc_oenbw-.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0241.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\4C35304A5A3259494E4970635F6F456E62572D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\4c35304a5a3259494e4970635f6f456e62572d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0241.041] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1176c [0241.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0241.041] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0241.127] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1176c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x1176c, lpOverlapped=0x0) returned 1 [0241.129] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11770, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x11770, lpOverlapped=0x0) returned 1 [0241.131] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.155] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.167] CloseHandle (hObject=0x10c) returned 1 [0241.167] CloseHandle (hObject=0xf8) returned 1 [0241.167] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\L50JZ2YINIpc_oEnbW-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\l50jz2yinipc_oenbw-.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\4C35304A5A3259494E4970635F6F456E62572D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\4c35304a5a3259494e4970635f6f456e62572d.png")) returned 0 [0241.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\4C35304A5A3259494E4970635F6F456E62572D.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\4c35304a5a3259494e4970635f6f456e62572d.png")) returned 0x20 [0241.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\L50JZ2YINIpc_oEnbW-.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf626f710, ftCreationTime.dwHighDateTime=0x1d5ba26, ftLastAccessTime.dwLowDateTime=0xae9b9f30, ftLastAccessTime.dwHighDateTime=0x1d5c3e1, ftLastWriteTime.dwLowDateTime=0xae9b9f30, ftLastWriteTime.dwHighDateTime=0x1d5c3e1, nFileSizeHigh=0x0, nFileSizeLow=0x1176c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="L50JZ2YINIpc_oEnbW-.png", cAlternateFileName="L50JZ2~1.PNG")) returned 0x324fd8 [0241.169] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf626f710, ftCreationTime.dwHighDateTime=0x1d5ba26, ftLastAccessTime.dwLowDateTime=0xae9b9f30, ftLastAccessTime.dwHighDateTime=0x1d5c3e1, ftLastWriteTime.dwLowDateTime=0xae9b9f30, ftLastWriteTime.dwHighDateTime=0x1d5c3e1, nFileSizeHigh=0x0, nFileSizeLow=0x1176c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="L50JZ2YINIpc_oEnbW-.png", cAlternateFileName="L50JZ2~1.PNG")) returned 0 [0241.169] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0241.169] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\L50JZ2YINIpc_oEnbW-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\l50jz2yinipc_oenbw-.png")) returned 1 [0241.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\L50JZ2YINIpc_oEnbW-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\l50jz2yinipc_oenbw-.png")) returned 0xffffffff [0241.171] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x279a92b0, ftCreationTime.dwHighDateTime=0x1d5be6a, ftLastAccessTime.dwLowDateTime=0x91e33240, ftLastAccessTime.dwHighDateTime=0x1d5bc02, ftLastWriteTime.dwLowDateTime=0x91e33240, ftLastWriteTime.dwHighDateTime=0x1d5bc02, nFileSizeHigh=0x0, nFileSizeLow=0x503e, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxpPTmRQ.mp4", cAlternateFileName="")) returned 1 [0241.171] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.171] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.171] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.171] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c293cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.171] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.172] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c293cc) returned 0x10ab [0241.172] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80f4be0, ftCreationTime.dwHighDateTime=0x1d5b729, ftLastAccessTime.dwLowDateTime=0xa2bc8c40, ftLastAccessTime.dwHighDateTime=0x1d5b68c, ftLastWriteTime.dwLowDateTime=0xa2bc8c40, ftLastWriteTime.dwHighDateTime=0x1d5b68c, nFileSizeHigh=0x0, nFileSizeLow=0x11f3f, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="tlHHy.swf", cAlternateFileName="")) returned 1 [0241.172] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.172] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.172] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.172] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a8f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.172] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.172] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a8f0) returned 0x10ab [0241.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\tlHHy.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\tlhhy.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0241.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\746C484879.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\746c484879.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0241.173] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11f3f [0241.173] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0241.174] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0241.245] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11f3f, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x11f3f, lpOverlapped=0x0) returned 1 [0241.247] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11f40, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x11f40, lpOverlapped=0x0) returned 1 [0241.249] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.271] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.282] CloseHandle (hObject=0xf8) returned 1 [0241.282] CloseHandle (hObject=0x10c) returned 1 [0241.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\tlHHy.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\tlhhy.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\746C484879.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\746c484879.swf")) returned 0 [0241.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\746C484879.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\746c484879.swf")) returned 0x20 [0241.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\tlHHy.swf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80f4be0, ftCreationTime.dwHighDateTime=0x1d5b729, ftLastAccessTime.dwLowDateTime=0xa2bc8c40, ftLastAccessTime.dwHighDateTime=0x1d5b68c, ftLastWriteTime.dwLowDateTime=0xa2bc8c40, ftLastWriteTime.dwHighDateTime=0x1d5b68c, nFileSizeHigh=0x0, nFileSizeLow=0x11f3f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="tlHHy.swf", cAlternateFileName="")) returned 0x324fd8 [0241.283] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80f4be0, ftCreationTime.dwHighDateTime=0x1d5b729, ftLastAccessTime.dwLowDateTime=0xa2bc8c40, ftLastAccessTime.dwHighDateTime=0x1d5b68c, ftLastWriteTime.dwLowDateTime=0xa2bc8c40, ftLastWriteTime.dwHighDateTime=0x1d5b68c, nFileSizeHigh=0x0, nFileSizeLow=0x11f3f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="tlHHy.swf", cAlternateFileName="")) returned 0 [0241.283] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0241.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\tlHHy.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\tlhhy.swf")) returned 1 [0241.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\UN6XF0CnxZ\\tlHHy.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\un6xf0cnxz\\tlhhy.swf")) returned 0xffffffff [0241.284] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80f4be0, ftCreationTime.dwHighDateTime=0x1d5b729, ftLastAccessTime.dwLowDateTime=0xa2bc8c40, ftLastAccessTime.dwHighDateTime=0x1d5b68c, ftLastWriteTime.dwLowDateTime=0xa2bc8c40, ftLastWriteTime.dwHighDateTime=0x1d5b68c, nFileSizeHigh=0x0, nFileSizeLow=0x11f3f, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="tlHHy.swf", cAlternateFileName="")) returned 0 [0241.284] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0241.284] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38546db0, ftCreationTime.dwHighDateTime=0x1d5c4f0, ftLastAccessTime.dwLowDateTime=0x41e61710, ftLastAccessTime.dwHighDateTime=0x1d5c4c4, ftLastWriteTime.dwLowDateTime=0x41e61710, ftLastWriteTime.dwHighDateTime=0x1d5c4c4, nFileSizeHigh=0x0, nFileSizeLow=0xe946, dwReserved0=0x456f5f34, dwReserved1=0x2d57626e, cFileName="YEUAeTOLP.wav", cAlternateFileName="YEUAET~1.WAV")) returned 1 [0241.285] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.285] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.285] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.285] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a8f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.285] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.285] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a8f0) returned 0x10ab [0241.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\YEUAeTOLP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\yeuaetolp.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0241.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\5945554165544F4C50.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\5945554165544f4c50.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0241.286] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe946 [0241.286] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0241.286] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0241.376] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe946, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xe946, lpOverlapped=0x0) returned 1 [0241.378] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe950, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xe950, lpOverlapped=0x0) returned 1 [0241.380] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.421] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.431] CloseHandle (hObject=0xfc) returned 1 [0241.431] CloseHandle (hObject=0x10c) returned 1 [0241.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\YEUAeTOLP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\yeuaetolp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\5945554165544F4C50.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\5945554165544f4c50.wav")) returned 0 [0241.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\5945554165544F4C50.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\5945554165544f4c50.wav")) returned 0x20 [0241.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\YEUAeTOLP.wav", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38546db0, ftCreationTime.dwHighDateTime=0x1d5c4f0, ftLastAccessTime.dwLowDateTime=0x41e61710, ftLastAccessTime.dwHighDateTime=0x1d5c4c4, ftLastWriteTime.dwLowDateTime=0x41e61710, ftLastWriteTime.dwHighDateTime=0x1d5c4c4, nFileSizeHigh=0x0, nFileSizeLow=0xe946, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="YEUAeTOLP.wav", cAlternateFileName="YEUAET~1.WAV")) returned 0x324f98 [0241.433] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38546db0, ftCreationTime.dwHighDateTime=0x1d5c4f0, ftLastAccessTime.dwLowDateTime=0x41e61710, ftLastAccessTime.dwHighDateTime=0x1d5c4c4, ftLastWriteTime.dwLowDateTime=0x41e61710, ftLastWriteTime.dwHighDateTime=0x1d5c4c4, nFileSizeHigh=0x0, nFileSizeLow=0xe946, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="YEUAeTOLP.wav", cAlternateFileName="YEUAET~1.WAV")) returned 0 [0241.433] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0241.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\YEUAeTOLP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\yeuaetolp.wav")) returned 1 [0241.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ynvyy2nEvZalx\\YEUAeTOLP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ynvyy2nevzalx\\yeuaetolp.wav")) returned 0xffffffff [0241.434] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38546db0, ftCreationTime.dwHighDateTime=0x1d5c4f0, ftLastAccessTime.dwLowDateTime=0x41e61710, ftLastAccessTime.dwHighDateTime=0x1d5c4c4, ftLastWriteTime.dwLowDateTime=0x41e61710, ftLastWriteTime.dwHighDateTime=0x1d5c4c4, nFileSizeHigh=0x0, nFileSizeLow=0xe946, dwReserved0=0x456f5f34, dwReserved1=0x2d57626e, cFileName="YEUAeTOLP.wav", cAlternateFileName="YEUAET~1.WAV")) returned 0 [0241.434] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0241.434] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58f970, ftCreationTime.dwHighDateTime=0x1d5b9bd, ftLastAccessTime.dwLowDateTime=0xb36a5230, ftLastAccessTime.dwHighDateTime=0x1d5c3c9, ftLastWriteTime.dwLowDateTime=0xb36a5230, ftLastWriteTime.dwHighDateTime=0x1d5c3c9, nFileSizeHigh=0x0, nFileSizeLow=0x14db7, dwReserved0=0x4e547661, dwReserved1=0x2e662d79, cFileName="YoBvV7hNOtXk.swf", cAlternateFileName="YOBVV7~1.SWF")) returned 1 [0241.435] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.435] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.435] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.435] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2822c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.435] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.435] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2822c) returned 0x10ab [0241.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YoBvV7hNOtXk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yobvv7hnotxk.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0241.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\596F42765637684E4F74586B.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\596f42765637684e4f74586b.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0241.437] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14db7 [0241.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0241.437] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0241.520] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14db7, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x14db7, lpOverlapped=0x0) returned 1 [0241.523] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14dc0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x14dc0, lpOverlapped=0x0) returned 1 [0241.525] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.548] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.559] CloseHandle (hObject=0xf0) returned 1 [0241.559] CloseHandle (hObject=0x10c) returned 1 [0241.559] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YoBvV7hNOtXk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yobvv7hnotxk.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\596F42765637684E4F74586B.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\596f42765637684e4f74586b.swf")) returned 0 [0241.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\596F42765637684E4F74586B.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\596f42765637684e4f74586b.swf")) returned 0x20 [0241.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YoBvV7hNOtXk.swf", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58f970, ftCreationTime.dwHighDateTime=0x1d5b9bd, ftLastAccessTime.dwLowDateTime=0xb36a5230, ftLastAccessTime.dwHighDateTime=0x1d5c3c9, ftLastWriteTime.dwLowDateTime=0xb36a5230, ftLastWriteTime.dwHighDateTime=0x1d5c3c9, nFileSizeHigh=0x0, nFileSizeLow=0x14db7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="YoBvV7hNOtXk.swf", cAlternateFileName="YOBVV7~1.SWF")) returned 0x324f58 [0241.560] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58f970, ftCreationTime.dwHighDateTime=0x1d5b9bd, ftLastAccessTime.dwLowDateTime=0xb36a5230, ftLastAccessTime.dwHighDateTime=0x1d5c3c9, ftLastWriteTime.dwLowDateTime=0xb36a5230, ftLastWriteTime.dwHighDateTime=0x1d5c3c9, nFileSizeHigh=0x0, nFileSizeLow=0x14db7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="YoBvV7hNOtXk.swf", cAlternateFileName="YOBVV7~1.SWF")) returned 0 [0241.560] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0241.560] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YoBvV7hNOtXk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yobvv7hnotxk.swf")) returned 1 [0241.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YoBvV7hNOtXk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yobvv7hnotxk.swf")) returned 0xffffffff [0241.562] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21eb0300, ftCreationTime.dwHighDateTime=0x1d5b626, ftLastAccessTime.dwLowDateTime=0x972001f0, ftLastAccessTime.dwHighDateTime=0x1d5b81c, ftLastWriteTime.dwLowDateTime=0x972001f0, ftLastWriteTime.dwHighDateTime=0x1d5b81c, nFileSizeHigh=0x0, nFileSizeLow=0x13ffd, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="yOsIas xPl.wav", cAlternateFileName="YOSIAS~1.WAV")) returned 1 [0241.562] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.562] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.562] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.562] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29738, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.562] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.562] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29738) returned 0x10ab [0241.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yOsIas xPl.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yosias xpl.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0241.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\794F734961732078506C.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\794f734961732078506c.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0241.564] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ffd [0241.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0241.564] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0241.662] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13ffd, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x13ffd, lpOverlapped=0x0) returned 1 [0241.664] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14000, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x14000, lpOverlapped=0x0) returned 1 [0241.666] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.688] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.708] CloseHandle (hObject=0x10c) returned 1 [0241.708] CloseHandle (hObject=0xf0) returned 1 [0241.708] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yOsIas xPl.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yosias xpl.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\794F734961732078506C.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\794f734961732078506c.wav")) returned 0 [0241.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\794F734961732078506C.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\794f734961732078506c.wav")) returned 0x20 [0241.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yOsIas xPl.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21eb0300, ftCreationTime.dwHighDateTime=0x1d5b626, ftLastAccessTime.dwLowDateTime=0x972001f0, ftLastAccessTime.dwHighDateTime=0x1d5b81c, ftLastWriteTime.dwLowDateTime=0x972001f0, ftLastWriteTime.dwHighDateTime=0x1d5b81c, nFileSizeHigh=0x0, nFileSizeLow=0x13ffd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="yOsIas xPl.wav", cAlternateFileName="YOSIAS~1.WAV")) returned 0x324f58 [0241.709] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21eb0300, ftCreationTime.dwHighDateTime=0x1d5b626, ftLastAccessTime.dwLowDateTime=0x972001f0, ftLastAccessTime.dwHighDateTime=0x1d5b81c, ftLastWriteTime.dwLowDateTime=0x972001f0, ftLastWriteTime.dwHighDateTime=0x1d5b81c, nFileSizeHigh=0x0, nFileSizeLow=0x13ffd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="yOsIas xPl.wav", cAlternateFileName="YOSIAS~1.WAV")) returned 0 [0241.709] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0241.709] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yOsIas xPl.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yosias xpl.wav")) returned 1 [0241.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yOsIas xPl.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yosias xpl.wav")) returned 0xffffffff [0241.710] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9838c20, ftCreationTime.dwHighDateTime=0x1d5c214, ftLastAccessTime.dwLowDateTime=0x3a54bc80, ftLastAccessTime.dwHighDateTime=0x1d5bcd7, ftLastWriteTime.dwLowDateTime=0x3a54bc80, ftLastWriteTime.dwHighDateTime=0x1d5bcd7, nFileSizeHigh=0x0, nFileSizeLow=0xbfb6, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="zBSPYvi.docx", cAlternateFileName="ZBSPYV~1.DOC")) returned 1 [0241.711] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.711] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.711] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.711] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.711] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.711] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28010) returned 0x10ab [0241.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zBSPYvi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbspyvi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0241.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7A425350597669.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7a425350597669.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0241.712] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbfb6 [0241.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0241.713] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0241.799] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbfb6, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xbfb6, lpOverlapped=0x0) returned 1 [0241.800] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbfc0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xbfc0, lpOverlapped=0x0) returned 1 [0241.802] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.824] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.834] CloseHandle (hObject=0xf0) returned 1 [0241.834] CloseHandle (hObject=0x10c) returned 1 [0241.834] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zBSPYvi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbspyvi.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7A425350597669.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7a425350597669.docx")) returned 0 [0241.835] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7A425350597669.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7a425350597669.docx")) returned 0x20 [0241.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zBSPYvi.docx", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9838c20, ftCreationTime.dwHighDateTime=0x1d5c214, ftLastAccessTime.dwLowDateTime=0x3a54bc80, ftLastAccessTime.dwHighDateTime=0x1d5bcd7, ftLastWriteTime.dwLowDateTime=0x3a54bc80, ftLastWriteTime.dwHighDateTime=0x1d5bcd7, nFileSizeHigh=0x0, nFileSizeLow=0xbfb6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="zBSPYvi.docx", cAlternateFileName="ZBSPYV~1.DOC")) returned 0x324f58 [0241.835] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9838c20, ftCreationTime.dwHighDateTime=0x1d5c214, ftLastAccessTime.dwLowDateTime=0x3a54bc80, ftLastAccessTime.dwHighDateTime=0x1d5bcd7, ftLastWriteTime.dwLowDateTime=0x3a54bc80, ftLastWriteTime.dwHighDateTime=0x1d5bcd7, nFileSizeHigh=0x0, nFileSizeLow=0xbfb6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="zBSPYvi.docx", cAlternateFileName="ZBSPYV~1.DOC")) returned 0 [0241.835] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0241.835] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zBSPYvi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbspyvi.docx")) returned 1 [0241.837] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zBSPYvi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbspyvi.docx")) returned 0xffffffff [0241.837] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211b2cf0, ftCreationTime.dwHighDateTime=0x1d5c429, ftLastAccessTime.dwLowDateTime=0x3f809540, ftLastAccessTime.dwHighDateTime=0x1d5c302, ftLastWriteTime.dwLowDateTime=0x3f809540, ftLastWriteTime.dwHighDateTime=0x1d5c302, nFileSizeHigh=0x0, nFileSizeLow=0x4e2e, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="ZEmHqhN11qa.png", cAlternateFileName="ZEMHQH~1.PNG")) returned 1 [0241.837] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.837] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.837] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.837] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c297ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.837] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.838] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c297ec) returned 0x10ab [0241.838] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZEmHqhN11qa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zemhqhn11qa.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0241.838] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5A456D4871684E31317161.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5a456d4871684e31317161.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0241.839] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e2e [0241.839] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0241.839] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0241.910] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4e2e, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x4e2e, lpOverlapped=0x0) returned 1 [0241.911] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4e30, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x4e30, lpOverlapped=0x0) returned 1 [0241.919] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.941] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.952] CloseHandle (hObject=0x10c) returned 1 [0241.952] CloseHandle (hObject=0xf0) returned 1 [0241.952] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZEmHqhN11qa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zemhqhn11qa.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5A456D4871684E31317161.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5a456d4871684e31317161.png")) returned 0 [0241.953] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5A456D4871684E31317161.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5a456d4871684e31317161.png")) returned 0x20 [0241.953] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZEmHqhN11qa.png", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211b2cf0, ftCreationTime.dwHighDateTime=0x1d5c429, ftLastAccessTime.dwLowDateTime=0x3f809540, ftLastAccessTime.dwHighDateTime=0x1d5c302, ftLastWriteTime.dwLowDateTime=0x3f809540, ftLastWriteTime.dwHighDateTime=0x1d5c302, nFileSizeHigh=0x0, nFileSizeLow=0x4e2e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ZEmHqhN11qa.png", cAlternateFileName="ZEMHQH~1.PNG")) returned 0x324f58 [0241.953] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211b2cf0, ftCreationTime.dwHighDateTime=0x1d5c429, ftLastAccessTime.dwLowDateTime=0x3f809540, ftLastAccessTime.dwHighDateTime=0x1d5c302, ftLastWriteTime.dwLowDateTime=0x3f809540, ftLastWriteTime.dwHighDateTime=0x1d5c302, nFileSizeHigh=0x0, nFileSizeLow=0x4e2e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ZEmHqhN11qa.png", cAlternateFileName="ZEMHQH~1.PNG")) returned 0 [0241.953] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0241.953] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZEmHqhN11qa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zemhqhn11qa.png")) returned 1 [0241.955] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZEmHqhN11qa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zemhqhn11qa.png")) returned 0xffffffff [0241.955] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf660f200, ftCreationTime.dwHighDateTime=0x1d5b7e5, ftLastAccessTime.dwLowDateTime=0x96d6ca90, ftLastAccessTime.dwHighDateTime=0x1d5bc67, ftLastWriteTime.dwLowDateTime=0x96d6ca90, ftLastWriteTime.dwHighDateTime=0x1d5bc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_cP-_edxhC", cAlternateFileName="_CP-_E~1")) returned 1 [0241.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf660f200, ftCreationTime.dwHighDateTime=0x1d5b7e5, ftLastAccessTime.dwLowDateTime=0x96d6ca90, ftLastAccessTime.dwHighDateTime=0x1d5bc67, ftLastWriteTime.dwLowDateTime=0x96d6ca90, ftLastWriteTime.dwHighDateTime=0x1d5bc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c006a, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0241.955] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf660f200, ftCreationTime.dwHighDateTime=0x1d5b7e5, ftLastAccessTime.dwLowDateTime=0x96d6ca90, ftLastAccessTime.dwHighDateTime=0x1d5bc67, ftLastWriteTime.dwLowDateTime=0x96d6ca90, ftLastWriteTime.dwHighDateTime=0x1d5bc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c006a, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0241.955] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bc75340, ftCreationTime.dwHighDateTime=0x1d5b71a, ftLastAccessTime.dwLowDateTime=0x386a2620, ftLastAccessTime.dwHighDateTime=0x1d5bfee, ftLastWriteTime.dwLowDateTime=0x386a2620, ftLastWriteTime.dwHighDateTime=0x1d5bfee, nFileSizeHigh=0x0, nFileSizeLow=0x27fe, dwReserved0=0x6c006a, dwReserved1=0x31c7b8, cFileName="8CjS.swf", cAlternateFileName="")) returned 1 [0241.955] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0241.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0241.956] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28068, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0241.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0241.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28068) returned 0x10ab [0241.956] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\8CjS.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\8cjs.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0241.956] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\38436A53.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\38436a53.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0241.957] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27fe [0241.957] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0241.957] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0242.044] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x27fe, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x27fe, lpOverlapped=0x0) returned 1 [0242.044] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x2800, lpOverlapped=0x0) returned 1 [0242.045] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.067] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.078] CloseHandle (hObject=0x10c) returned 1 [0242.078] CloseHandle (hObject=0xfc) returned 1 [0242.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\8CjS.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\8cjs.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\38436A53.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\38436a53.swf")) returned 0 [0242.079] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\38436A53.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\38436a53.swf")) returned 0x20 [0242.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\8CjS.swf", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bc75340, ftCreationTime.dwHighDateTime=0x1d5b71a, ftLastAccessTime.dwLowDateTime=0x386a2620, ftLastAccessTime.dwHighDateTime=0x1d5bfee, ftLastWriteTime.dwLowDateTime=0x386a2620, ftLastWriteTime.dwHighDateTime=0x1d5bfee, nFileSizeHigh=0x0, nFileSizeLow=0x27fe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8CjS.swf", cAlternateFileName="")) returned 0x324f98 [0242.079] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bc75340, ftCreationTime.dwHighDateTime=0x1d5b71a, ftLastAccessTime.dwLowDateTime=0x386a2620, ftLastAccessTime.dwHighDateTime=0x1d5bfee, ftLastWriteTime.dwLowDateTime=0x386a2620, ftLastWriteTime.dwHighDateTime=0x1d5bfee, nFileSizeHigh=0x0, nFileSizeLow=0x27fe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8CjS.swf", cAlternateFileName="")) returned 0 [0242.079] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0242.079] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\8CjS.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\8cjs.swf")) returned 1 [0242.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\8CjS.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\8cjs.swf")) returned 0xffffffff [0242.080] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99b62a10, ftCreationTime.dwHighDateTime=0x1d5bf57, ftLastAccessTime.dwLowDateTime=0x6bd2f40, ftLastAccessTime.dwHighDateTime=0x1d5c4a4, ftLastWriteTime.dwLowDateTime=0x6bd2f40, ftLastWriteTime.dwHighDateTime=0x1d5c4a4, nFileSizeHigh=0x0, nFileSizeLow=0x18931, dwReserved0=0x0, dwReserved1=0x0, cFileName="9VIOhXe.mp4", cAlternateFileName="")) returned 1 [0242.080] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.080] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.080] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.080] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c282dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.080] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.080] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c282dc) returned 0x10ab [0242.081] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdadd0470, ftCreationTime.dwHighDateTime=0x1d5c180, ftLastAccessTime.dwLowDateTime=0xd9135d80, ftLastAccessTime.dwHighDateTime=0x1d5c0bb, ftLastWriteTime.dwLowDateTime=0xd9135d80, ftLastWriteTime.dwHighDateTime=0x1d5c0bb, nFileSizeHigh=0x0, nFileSizeLow=0x15733, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="esRbL6YGg9mHVD.png", cAlternateFileName="ESRBL6~1.PNG")) returned 1 [0242.081] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.081] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.081] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.081] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2837c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.081] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.081] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2837c) returned 0x10ab [0242.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\esRbL6YGg9mHVD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\esrbl6ygg9mhvd.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0242.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\657352624C36594767396D485644.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\657352624c36594767396d485644.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0242.082] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15733 [0242.082] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0242.082] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0242.168] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x15733, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x15733, lpOverlapped=0x0) returned 1 [0242.170] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x15740, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x15740, lpOverlapped=0x0) returned 1 [0242.173] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.194] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.208] CloseHandle (hObject=0xfc) returned 1 [0242.208] CloseHandle (hObject=0x10c) returned 1 [0242.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\esRbL6YGg9mHVD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\esrbl6ygg9mhvd.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\657352624C36594767396D485644.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\657352624c36594767396d485644.png")) returned 0 [0242.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\657352624C36594767396D485644.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\657352624c36594767396d485644.png")) returned 0x20 [0242.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\esRbL6YGg9mHVD.png", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdadd0470, ftCreationTime.dwHighDateTime=0x1d5c180, ftLastAccessTime.dwLowDateTime=0xd9135d80, ftLastAccessTime.dwHighDateTime=0x1d5c0bb, ftLastWriteTime.dwLowDateTime=0xd9135d80, ftLastWriteTime.dwHighDateTime=0x1d5c0bb, nFileSizeHigh=0x0, nFileSizeLow=0x15733, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="esRbL6YGg9mHVD.png", cAlternateFileName="ESRBL6~1.PNG")) returned 0x324f98 [0242.209] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdadd0470, ftCreationTime.dwHighDateTime=0x1d5c180, ftLastAccessTime.dwLowDateTime=0xd9135d80, ftLastAccessTime.dwHighDateTime=0x1d5c0bb, ftLastWriteTime.dwLowDateTime=0xd9135d80, ftLastWriteTime.dwHighDateTime=0x1d5c0bb, nFileSizeHigh=0x0, nFileSizeLow=0x15733, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="esRbL6YGg9mHVD.png", cAlternateFileName="ESRBL6~1.PNG")) returned 0 [0242.209] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0242.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\esRbL6YGg9mHVD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\esrbl6ygg9mhvd.png")) returned 1 [0242.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\esRbL6YGg9mHVD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\esrbl6ygg9mhvd.png")) returned 0xffffffff [0242.211] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5b87c0, ftCreationTime.dwHighDateTime=0x1d5c45a, ftLastAccessTime.dwLowDateTime=0xd6f81910, ftLastAccessTime.dwHighDateTime=0x1d5c2f4, ftLastWriteTime.dwLowDateTime=0xd6f81910, ftLastWriteTime.dwHighDateTime=0x1d5c2f4, nFileSizeHigh=0x0, nFileSizeLow=0x114aa, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="uPWQ9hVwHw8DGqMGBJsu.xls", cAlternateFileName="UPWQ9H~1.XLS")) returned 1 [0242.212] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.212] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.212] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.212] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28628, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.212] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.212] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28628) returned 0x10ab [0242.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\uPWQ9hVwHw8DGqMGBJsu.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\upwq9hvwhw8dgqmgbjsu.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0242.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\75505751396856774877384447714D47424A7375.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\75505751396856774877384447714d47424a7375.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0242.213] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114aa [0242.213] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0242.213] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0242.300] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x114aa, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x114aa, lpOverlapped=0x0) returned 1 [0242.302] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x114b0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x114b0, lpOverlapped=0x0) returned 1 [0242.303] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.326] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.336] CloseHandle (hObject=0x10c) returned 1 [0242.336] CloseHandle (hObject=0xfc) returned 1 [0242.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\uPWQ9hVwHw8DGqMGBJsu.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\upwq9hvwhw8dgqmgbjsu.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\75505751396856774877384447714D47424A7375.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\75505751396856774877384447714d47424a7375.xls")) returned 0 [0242.337] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\75505751396856774877384447714D47424A7375.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\75505751396856774877384447714d47424a7375.xls")) returned 0x20 [0242.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\uPWQ9hVwHw8DGqMGBJsu.xls", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5b87c0, ftCreationTime.dwHighDateTime=0x1d5c45a, ftLastAccessTime.dwLowDateTime=0xd6f81910, ftLastAccessTime.dwHighDateTime=0x1d5c2f4, ftLastWriteTime.dwLowDateTime=0xd6f81910, ftLastWriteTime.dwHighDateTime=0x1d5c2f4, nFileSizeHigh=0x0, nFileSizeLow=0x114aa, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uPWQ9hVwHw8DGqMGBJsu.xls", cAlternateFileName="UPWQ9H~1.XLS")) returned 0x324f98 [0242.338] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5b87c0, ftCreationTime.dwHighDateTime=0x1d5c45a, ftLastAccessTime.dwLowDateTime=0xd6f81910, ftLastAccessTime.dwHighDateTime=0x1d5c2f4, ftLastWriteTime.dwLowDateTime=0xd6f81910, ftLastWriteTime.dwHighDateTime=0x1d5c2f4, nFileSizeHigh=0x0, nFileSizeLow=0x114aa, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uPWQ9hVwHw8DGqMGBJsu.xls", cAlternateFileName="UPWQ9H~1.XLS")) returned 0 [0242.338] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0242.338] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\uPWQ9hVwHw8DGqMGBJsu.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\upwq9hvwhw8dgqmgbjsu.xls")) returned 1 [0242.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\uPWQ9hVwHw8DGqMGBJsu.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\upwq9hvwhw8dgqmgbjsu.xls")) returned 0xffffffff [0242.340] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c7a95e0, ftCreationTime.dwHighDateTime=0x1d5c3a5, ftLastAccessTime.dwLowDateTime=0x3bbdf3d0, ftLastAccessTime.dwHighDateTime=0x1d5bcb3, ftLastWriteTime.dwLowDateTime=0x3bbdf3d0, ftLastWriteTime.dwHighDateTime=0x1d5bcb3, nFileSizeHigh=0x0, nFileSizeLow=0xb29a, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="WWeEho0ambdi9j9Uzrzu.xls", cAlternateFileName="WWEEHO~1.XLS")) returned 1 [0242.340] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.340] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.340] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.340] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2894c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.340] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.341] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2894c) returned 0x10ab [0242.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\WWeEho0ambdi9j9Uzrzu.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\wweeho0ambdi9j9uzrzu.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0242.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\57576545686F30616D626469396A39557A727A75.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\57576545686f30616d626469396a39557a727a75.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0242.342] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb29a [0242.342] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0242.342] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0242.436] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb29a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xb29a, lpOverlapped=0x0) returned 1 [0242.438] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb2a0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xb2a0, lpOverlapped=0x0) returned 1 [0242.439] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.461] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.472] CloseHandle (hObject=0xfc) returned 1 [0242.472] CloseHandle (hObject=0x10c) returned 1 [0242.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\WWeEho0ambdi9j9Uzrzu.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\wweeho0ambdi9j9uzrzu.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\57576545686F30616D626469396A39557A727A75.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\57576545686f30616d626469396a39557a727a75.xls")) returned 0 [0242.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\57576545686F30616D626469396A39557A727A75.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\57576545686f30616d626469396a39557a727a75.xls")) returned 0x20 [0242.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\WWeEho0ambdi9j9Uzrzu.xls", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c7a95e0, ftCreationTime.dwHighDateTime=0x1d5c3a5, ftLastAccessTime.dwLowDateTime=0x3bbdf3d0, ftLastAccessTime.dwHighDateTime=0x1d5bcb3, ftLastWriteTime.dwLowDateTime=0x3bbdf3d0, ftLastWriteTime.dwHighDateTime=0x1d5bcb3, nFileSizeHigh=0x0, nFileSizeLow=0xb29a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="WWeEho0ambdi9j9Uzrzu.xls", cAlternateFileName="WWEEHO~1.XLS")) returned 0x324f98 [0242.476] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c7a95e0, ftCreationTime.dwHighDateTime=0x1d5c3a5, ftLastAccessTime.dwLowDateTime=0x3bbdf3d0, ftLastAccessTime.dwHighDateTime=0x1d5bcb3, ftLastWriteTime.dwLowDateTime=0x3bbdf3d0, ftLastWriteTime.dwHighDateTime=0x1d5bcb3, nFileSizeHigh=0x0, nFileSizeLow=0xb29a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="WWeEho0ambdi9j9Uzrzu.xls", cAlternateFileName="WWEEHO~1.XLS")) returned 0 [0242.476] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0242.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\WWeEho0ambdi9j9Uzrzu.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\wweeho0ambdi9j9uzrzu.xls")) returned 1 [0242.478] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_cP-_edxhC\\WWeEho0ambdi9j9Uzrzu.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cp-_edxhc\\wweeho0ambdi9j9uzrzu.xls")) returned 0xffffffff [0242.478] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c7a95e0, ftCreationTime.dwHighDateTime=0x1d5c3a5, ftLastAccessTime.dwLowDateTime=0x3bbdf3d0, ftLastAccessTime.dwHighDateTime=0x1d5bcb3, ftLastWriteTime.dwLowDateTime=0x3bbdf3d0, ftLastWriteTime.dwHighDateTime=0x1d5bcb3, nFileSizeHigh=0x0, nFileSizeLow=0xb29a, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="WWeEho0ambdi9j9Uzrzu.xls", cAlternateFileName="WWEEHO~1.XLS")) returned 0 [0242.478] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0242.478] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf660f200, ftCreationTime.dwHighDateTime=0x1d5b7e5, ftLastAccessTime.dwLowDateTime=0x96d6ca90, ftLastAccessTime.dwHighDateTime=0x1d5bc67, ftLastWriteTime.dwLowDateTime=0x96d6ca90, ftLastWriteTime.dwHighDateTime=0x1d5bc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_cP-_edxhC", cAlternateFileName="_CP-_E~1")) returned 0 [0242.478] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0242.478] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f158550, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f158550, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e702e, dwReserved1=0x6d2e6e66, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0242.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f158550, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f158550, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x396a3969, dwReserved1=0x7a727a55, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0242.479] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f158550, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f158550, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x396a3969, dwReserved1=0x7a727a55, cFileName="..", cAlternateFileName="")) returned 1 [0242.479] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc94348c0, ftCreationTime.dwHighDateTime=0x1d55739, ftLastAccessTime.dwLowDateTime=0x851f9b40, ftLastAccessTime.dwHighDateTime=0x1d57b32, ftLastWriteTime.dwLowDateTime=0x851f9b40, ftLastWriteTime.dwHighDateTime=0x1d57b32, nFileSizeHigh=0x0, nFileSizeLow=0xd1c4, dwReserved0=0x396a3969, dwReserved1=0x7a727a55, cFileName="2mh1.xlsx", cAlternateFileName="2MH1~1.XLS")) returned 1 [0242.480] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.480] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.480] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.480] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28cc0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.480] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.480] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28cc0) returned 0x10ab [0242.480] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba78f70, ftCreationTime.dwHighDateTime=0x1d58076, ftLastAccessTime.dwLowDateTime=0x2dfa4a90, ftLastAccessTime.dwHighDateTime=0x1d5b19c, ftLastWriteTime.dwLowDateTime=0x2dfa4a90, ftLastWriteTime.dwHighDateTime=0x1d5b19c, nFileSizeHigh=0x0, nFileSizeLow=0xeb9f, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="ba_Aj.pptx", cAlternateFileName="BA_AJ~1.PPT")) returned 1 [0242.481] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.481] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.481] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.481] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28d60, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.481] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.481] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28d60) returned 0x10ab [0242.481] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x473c7970, ftCreationTime.dwHighDateTime=0x1d5ba60, ftLastAccessTime.dwLowDateTime=0xc221d0e0, ftLastAccessTime.dwHighDateTime=0x1d5b961, ftLastWriteTime.dwLowDateTime=0xc221d0e0, ftLastWriteTime.dwHighDateTime=0x1d5b961, nFileSizeHigh=0x0, nFileSizeLow=0x116b7, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="CEtI_2JiZ 3mdnbliKF5.ods", cAlternateFileName="CETI_2~1.ODS")) returned 1 [0242.481] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.481] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.481] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.481] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28e48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.481] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.481] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28e48) returned 0x10ab [0242.481] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7899bad0, ftCreationTime.dwHighDateTime=0x1d54bcc, ftLastAccessTime.dwLowDateTime=0xcbb6f650, ftLastAccessTime.dwHighDateTime=0x1d59be1, ftLastWriteTime.dwLowDateTime=0xcbb6f650, ftLastWriteTime.dwHighDateTime=0x1d59be1, nFileSizeHigh=0x0, nFileSizeLow=0x3c9b, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="cTHvtkFjn9.xlsx", cAlternateFileName="CTHVTK~1.XLS")) returned 1 [0242.482] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.482] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.482] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.482] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28f0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.482] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.482] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28f0c) returned 0x10ab [0242.482] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0242.482] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.482] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.482] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.482] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28fac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.482] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.483] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28fac) returned 0x10ab [0242.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0242.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0242.484] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192 [0242.484] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0242.484] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0242.579] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x192, lpOverlapped=0x0) returned 1 [0242.580] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x1a0, lpOverlapped=0x0) returned 1 [0242.581] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.604] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.614] CloseHandle (hObject=0xf0) returned 1 [0242.615] CloseHandle (hObject=0x10c) returned 1 [0242.615] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6465736b746f70.ini")) returned 0 [0242.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6465736b746f70.ini")) returned 0x20 [0242.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0242.616] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0242.616] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0242.616] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini")) returned 1 [0242.617] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini")) returned 0xffffffff [0242.617] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbebe41d0, ftCreationTime.dwHighDateTime=0x1d5b764, ftLastAccessTime.dwLowDateTime=0x2e82e340, ftLastAccessTime.dwHighDateTime=0x1d5bba7, ftLastWriteTime.dwLowDateTime=0x2e82e340, ftLastWriteTime.dwHighDateTime=0x1d5bba7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="epGfDJqj", cAlternateFileName="")) returned 1 [0242.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbebe41d0, ftCreationTime.dwHighDateTime=0x1d5b764, ftLastAccessTime.dwLowDateTime=0x2e82e340, ftLastAccessTime.dwHighDateTime=0x1d5bba7, ftLastWriteTime.dwLowDateTime=0x2e82e340, ftLastWriteTime.dwHighDateTime=0x1d5bba7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680066, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0242.617] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbebe41d0, ftCreationTime.dwHighDateTime=0x1d5b764, ftLastAccessTime.dwLowDateTime=0x2e82e340, ftLastAccessTime.dwHighDateTime=0x1d5bba7, ftLastWriteTime.dwLowDateTime=0x2e82e340, ftLastWriteTime.dwHighDateTime=0x1d5bba7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680066, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0242.617] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb978050, ftCreationTime.dwHighDateTime=0x1d5bb02, ftLastAccessTime.dwLowDateTime=0xdba5f90, ftLastAccessTime.dwHighDateTime=0x1d5bd7c, ftLastWriteTime.dwLowDateTime=0xdba5f90, ftLastWriteTime.dwHighDateTime=0x1d5bd7c, nFileSizeHigh=0x0, nFileSizeLow=0x8770, dwReserved0=0x680066, dwReserved1=0x31c7b8, cFileName="44KQs5EVMXuZ.csv", cAlternateFileName="44KQS5~1.CSV")) returned 1 [0242.618] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.618] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.618] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.618] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29278, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.618] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.618] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29278) returned 0x10ab [0242.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\44KQs5EVMXuZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\44kqs5evmxuz.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0242.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\34344B51733545564D58755A.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\34344b51733545564d58755a.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0242.619] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8770 [0242.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0242.620] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0242.691] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8770, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x8770, lpOverlapped=0x0) returned 1 [0242.692] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x8780, lpOverlapped=0x0) returned 1 [0242.693] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.725] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.736] CloseHandle (hObject=0xf0) returned 1 [0242.736] CloseHandle (hObject=0xfc) returned 1 [0242.736] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\44KQs5EVMXuZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\44kqs5evmxuz.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\34344B51733545564D58755A.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\34344b51733545564d58755a.csv")) returned 0 [0242.737] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\34344B51733545564D58755A.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\34344b51733545564d58755a.csv")) returned 0x20 [0242.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\44KQs5EVMXuZ.csv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb978050, ftCreationTime.dwHighDateTime=0x1d5bb02, ftLastAccessTime.dwLowDateTime=0xdba5f90, ftLastAccessTime.dwHighDateTime=0x1d5bd7c, ftLastWriteTime.dwLowDateTime=0xdba5f90, ftLastWriteTime.dwHighDateTime=0x1d5bd7c, nFileSizeHigh=0x0, nFileSizeLow=0x8770, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="44KQs5EVMXuZ.csv", cAlternateFileName="44KQS5~1.CSV")) returned 0x324f98 [0242.737] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb978050, ftCreationTime.dwHighDateTime=0x1d5bb02, ftLastAccessTime.dwLowDateTime=0xdba5f90, ftLastAccessTime.dwHighDateTime=0x1d5bd7c, ftLastWriteTime.dwLowDateTime=0xdba5f90, ftLastWriteTime.dwHighDateTime=0x1d5bd7c, nFileSizeHigh=0x0, nFileSizeLow=0x8770, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="44KQs5EVMXuZ.csv", cAlternateFileName="44KQS5~1.CSV")) returned 0 [0242.737] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0242.737] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\44KQs5EVMXuZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\44kqs5evmxuz.csv")) returned 1 [0242.739] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\44KQs5EVMXuZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\44kqs5evmxuz.csv")) returned 0xffffffff [0242.739] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64cb9170, ftCreationTime.dwHighDateTime=0x1d5c5db, ftLastAccessTime.dwLowDateTime=0x7d514880, ftLastAccessTime.dwHighDateTime=0x1d5b6c1, ftLastWriteTime.dwLowDateTime=0x7d514880, ftLastWriteTime.dwHighDateTime=0x1d5b6c1, nFileSizeHigh=0x0, nFileSizeLow=0x188c8, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="kkCWrV.odt", cAlternateFileName="")) returned 1 [0242.740] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.740] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29610, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29610) returned 0x10ab [0242.740] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3933b220, ftCreationTime.dwHighDateTime=0x1d5bad4, ftLastAccessTime.dwLowDateTime=0x2b838960, ftLastAccessTime.dwHighDateTime=0x1d5bfee, ftLastWriteTime.dwLowDateTime=0x2b838960, ftLastWriteTime.dwHighDateTime=0x1d5bfee, nFileSizeHigh=0x0, nFileSizeLow=0x84e, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="MnXu.ods", cAlternateFileName="")) returned 1 [0242.740] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.740] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c296bc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c296bc) returned 0x10ab [0242.741] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13c81500, ftCreationTime.dwHighDateTime=0x1d5c374, ftLastAccessTime.dwLowDateTime=0xcf0b7ec0, ftLastAccessTime.dwHighDateTime=0x1d5b84c, ftLastWriteTime.dwLowDateTime=0xcf0b7ec0, ftLastWriteTime.dwHighDateTime=0x1d5b84c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="YZy1uEfpD3CWNcpqF", cAlternateFileName="YZY1UE~1")) returned 1 [0242.741] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13c81500, ftCreationTime.dwHighDateTime=0x1d5c374, ftLastAccessTime.dwLowDateTime=0xcf0b7ec0, ftLastAccessTime.dwHighDateTime=0x1d5b84c, ftLastWriteTime.dwLowDateTime=0xcf0b7ec0, ftLastWriteTime.dwHighDateTime=0x1d5b84c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0242.741] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13c81500, ftCreationTime.dwHighDateTime=0x1d5c374, ftLastAccessTime.dwLowDateTime=0xcf0b7ec0, ftLastAccessTime.dwHighDateTime=0x1d5b84c, ftLastWriteTime.dwLowDateTime=0xcf0b7ec0, ftLastWriteTime.dwHighDateTime=0x1d5b84c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 1 [0242.741] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81d90a40, ftCreationTime.dwHighDateTime=0x1d5c509, ftLastAccessTime.dwLowDateTime=0xc3b43540, ftLastAccessTime.dwHighDateTime=0x1d5c0f7, ftLastWriteTime.dwLowDateTime=0xc3b43540, ftLastWriteTime.dwHighDateTime=0x1d5c0f7, nFileSizeHigh=0x0, nFileSizeLow=0x13def, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="2YFN3Eu7G N6GsxWsubh.ots", cAlternateFileName="2YFN3E~1.OTS")) returned 1 [0242.741] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.741] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.741] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.741] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29870, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.741] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.741] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29870) returned 0x10ab [0242.741] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c8c1fe0, ftCreationTime.dwHighDateTime=0x1d5be3f, ftLastAccessTime.dwLowDateTime=0x9dcf0670, ftLastAccessTime.dwHighDateTime=0x1d5c043, ftLastWriteTime.dwLowDateTime=0x9dcf0670, ftLastWriteTime.dwHighDateTime=0x1d5c043, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="jeAQDeqHkc", cAlternateFileName="JEAQDE~1")) returned 1 [0242.741] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c8c1fe0, ftCreationTime.dwHighDateTime=0x1d5be3f, ftLastAccessTime.dwLowDateTime=0x9dcf0670, ftLastAccessTime.dwHighDateTime=0x1d5c043, ftLastWriteTime.dwLowDateTime=0x9dcf0670, ftLastWriteTime.dwHighDateTime=0x1d5c043, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee74, dwReserved1=0x18ee74, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0242.742] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c8c1fe0, ftCreationTime.dwHighDateTime=0x1d5be3f, ftLastAccessTime.dwLowDateTime=0x9dcf0670, ftLastAccessTime.dwHighDateTime=0x1d5c043, ftLastWriteTime.dwLowDateTime=0x9dcf0670, ftLastWriteTime.dwHighDateTime=0x1d5c043, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee74, dwReserved1=0x18ee74, cFileName="..", cAlternateFileName="")) returned 1 [0242.742] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97fab330, ftCreationTime.dwHighDateTime=0x1d5bdfe, ftLastAccessTime.dwLowDateTime=0xb1b45c50, ftLastAccessTime.dwHighDateTime=0x1d5bb9b, ftLastWriteTime.dwLowDateTime=0xb1b45c50, ftLastWriteTime.dwHighDateTime=0x1d5bb9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee74, dwReserved1=0x18ee74, cFileName="AP8lSl0d6VwBCQ", cAlternateFileName="AP8LSL~1")) returned 1 [0242.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97fab330, ftCreationTime.dwHighDateTime=0x1d5bdfe, ftLastAccessTime.dwLowDateTime=0xb1b45c50, ftLastAccessTime.dwHighDateTime=0x1d5bb9b, ftLastWriteTime.dwLowDateTime=0xb1b45c50, ftLastWriteTime.dwHighDateTime=0x1d5bb9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0242.742] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97fab330, ftCreationTime.dwHighDateTime=0x1d5bdfe, ftLastAccessTime.dwLowDateTime=0xb1b45c50, ftLastAccessTime.dwHighDateTime=0x1d5bb9b, ftLastWriteTime.dwLowDateTime=0xb1b45c50, ftLastWriteTime.dwHighDateTime=0x1d5bb9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.742] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda884730, ftCreationTime.dwHighDateTime=0x1d5bf2f, ftLastAccessTime.dwLowDateTime=0xfff06380, ftLastAccessTime.dwHighDateTime=0x1d5bb11, ftLastWriteTime.dwLowDateTime=0xfff06380, ftLastWriteTime.dwHighDateTime=0x1d5bb11, nFileSizeHigh=0x0, nFileSizeLow=0x168a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="9bUheDCUAs1D0.ppt", cAlternateFileName="9BUHED~1.PPT")) returned 1 [0242.742] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.742] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.742] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.742] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29b30, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.742] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.743] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29b30) returned 0x10ab [0242.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9bUheDCUAs1D0.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\9buhedcuas1d0.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0242.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\39625568654443554173314430.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\39625568654443554173314430.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0242.744] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x168a2 [0242.744] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0242.744] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0242.831] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x168a2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x168a2, lpOverlapped=0x0) returned 1 [0242.833] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x168b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x168b0, lpOverlapped=0x0) returned 1 [0242.835] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.857] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.868] CloseHandle (hObject=0xf4) returned 1 [0242.868] CloseHandle (hObject=0x100) returned 1 [0242.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9bUheDCUAs1D0.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\9buhedcuas1d0.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\39625568654443554173314430.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\39625568654443554173314430.ppt")) returned 0 [0242.870] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\39625568654443554173314430.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\39625568654443554173314430.ppt")) returned 0x20 [0242.870] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9bUheDCUAs1D0.ppt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda884730, ftCreationTime.dwHighDateTime=0x1d5bf2f, ftLastAccessTime.dwLowDateTime=0xfff06380, ftLastAccessTime.dwHighDateTime=0x1d5bb11, ftLastWriteTime.dwLowDateTime=0xfff06380, ftLastWriteTime.dwHighDateTime=0x1d5bb11, nFileSizeHigh=0x0, nFileSizeLow=0x168a2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9bUheDCUAs1D0.ppt", cAlternateFileName="9BUHED~1.PPT")) returned 0x325058 [0242.870] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda884730, ftCreationTime.dwHighDateTime=0x1d5bf2f, ftLastAccessTime.dwLowDateTime=0xfff06380, ftLastAccessTime.dwHighDateTime=0x1d5bb11, ftLastWriteTime.dwLowDateTime=0xfff06380, ftLastWriteTime.dwHighDateTime=0x1d5bb11, nFileSizeHigh=0x0, nFileSizeLow=0x168a2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="9bUheDCUAs1D0.ppt", cAlternateFileName="9BUHED~1.PPT")) returned 0 [0242.870] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0242.871] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9bUheDCUAs1D0.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\9buhedcuas1d0.ppt")) returned 1 [0242.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9bUheDCUAs1D0.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\9buhedcuas1d0.ppt")) returned 0xffffffff [0242.872] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9211be60, ftCreationTime.dwHighDateTime=0x1d5c00a, ftLastAccessTime.dwLowDateTime=0xd778d080, ftLastAccessTime.dwHighDateTime=0x1d5bdbf, ftLastWriteTime.dwLowDateTime=0xd778d080, ftLastWriteTime.dwHighDateTime=0x1d5bdbf, nFileSizeHigh=0x0, nFileSizeLow=0x112fd, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="9qzNoujUhPYr1ntDw.xls", cAlternateFileName="9QZNOU~1.XLS")) returned 1 [0242.873] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0242.873] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.873] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0242.873] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0242.873] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0242.873] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f90) returned 0x10ab [0242.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9qzNoujUhPYr1ntDw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\9qznoujuhpyr1ntdw.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0242.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\39717A4E6F756A5568505972316E744477.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\39717a4e6f756a5568505972316e744477.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0242.874] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112fd [0242.874] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0242.874] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0242.965] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x112fd, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x112fd, lpOverlapped=0x0) returned 1 [0242.967] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11300, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x11300, lpOverlapped=0x0) returned 1 [0242.969] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.992] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.003] CloseHandle (hObject=0x100) returned 1 [0243.003] CloseHandle (hObject=0xf4) returned 1 [0243.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9qzNoujUhPYr1ntDw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\9qznoujuhpyr1ntdw.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\39717A4E6F756A5568505972316E744477.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\39717a4e6f756a5568505972316e744477.xls")) returned 0 [0243.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\39717A4E6F756A5568505972316E744477.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\39717a4e6f756a5568505972316e744477.xls")) returned 0x20 [0243.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9qzNoujUhPYr1ntDw.xls", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9211be60, ftCreationTime.dwHighDateTime=0x1d5c00a, ftLastAccessTime.dwLowDateTime=0xd778d080, ftLastAccessTime.dwHighDateTime=0x1d5bdbf, ftLastWriteTime.dwLowDateTime=0xd778d080, ftLastWriteTime.dwHighDateTime=0x1d5bdbf, nFileSizeHigh=0x0, nFileSizeLow=0x112fd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9qzNoujUhPYr1ntDw.xls", cAlternateFileName="9QZNOU~1.XLS")) returned 0x325058 [0243.004] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9211be60, ftCreationTime.dwHighDateTime=0x1d5c00a, ftLastAccessTime.dwLowDateTime=0xd778d080, ftLastAccessTime.dwHighDateTime=0x1d5bdbf, ftLastWriteTime.dwLowDateTime=0xd778d080, ftLastWriteTime.dwHighDateTime=0x1d5bdbf, nFileSizeHigh=0x0, nFileSizeLow=0x112fd, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="9qzNoujUhPYr1ntDw.xls", cAlternateFileName="9QZNOU~1.XLS")) returned 0 [0243.004] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0243.004] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9qzNoujUhPYr1ntDw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\9qznoujuhpyr1ntdw.xls")) returned 1 [0243.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\9qzNoujUhPYr1ntDw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\9qznoujuhpyr1ntdw.xls")) returned 0xffffffff [0243.006] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b43280, ftCreationTime.dwHighDateTime=0x1d5bfe2, ftLastAccessTime.dwLowDateTime=0x5ced7f50, ftLastAccessTime.dwHighDateTime=0x1d5c3f5, ftLastWriteTime.dwLowDateTime=0x5ced7f50, ftLastWriteTime.dwHighDateTime=0x1d5c3f5, nFileSizeHigh=0x0, nFileSizeLow=0xf51f, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="kICtw75iUSE4jdT.rtf", cAlternateFileName="KICTW7~1.RTF")) returned 1 [0243.006] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.006] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.006] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.006] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a4c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.006] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.006] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a4c4) returned 0x10ab [0243.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\kICtw75iUSE4jdT.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\kictw75iuse4jdt.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0243.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\6B49437477373569555345346A6454.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\6b49437477373569555345346a6454.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0243.008] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf51f [0243.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0243.008] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0243.095] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf51f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xf51f, lpOverlapped=0x0) returned 1 [0243.097] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf520, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf520, lpOverlapped=0x0) returned 1 [0243.099] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.120] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.131] CloseHandle (hObject=0xf4) returned 1 [0243.131] CloseHandle (hObject=0x100) returned 1 [0243.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\kICtw75iUSE4jdT.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\kictw75iuse4jdt.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\6B49437477373569555345346A6454.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\6b49437477373569555345346a6454.rtf")) returned 0 [0243.132] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\6B49437477373569555345346A6454.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\6b49437477373569555345346a6454.rtf")) returned 0x20 [0243.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\kICtw75iUSE4jdT.rtf", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b43280, ftCreationTime.dwHighDateTime=0x1d5bfe2, ftLastAccessTime.dwLowDateTime=0x5ced7f50, ftLastAccessTime.dwHighDateTime=0x1d5c3f5, ftLastWriteTime.dwLowDateTime=0x5ced7f50, ftLastWriteTime.dwHighDateTime=0x1d5c3f5, nFileSizeHigh=0x0, nFileSizeLow=0xf51f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="kICtw75iUSE4jdT.rtf", cAlternateFileName="KICTW7~1.RTF")) returned 0x325058 [0243.132] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b43280, ftCreationTime.dwHighDateTime=0x1d5bfe2, ftLastAccessTime.dwLowDateTime=0x5ced7f50, ftLastAccessTime.dwHighDateTime=0x1d5c3f5, ftLastWriteTime.dwLowDateTime=0x5ced7f50, ftLastWriteTime.dwHighDateTime=0x1d5c3f5, nFileSizeHigh=0x0, nFileSizeLow=0xf51f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="kICtw75iUSE4jdT.rtf", cAlternateFileName="KICTW7~1.RTF")) returned 0 [0243.132] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0243.132] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\kICtw75iUSE4jdT.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\kictw75iuse4jdt.rtf")) returned 1 [0243.134] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\jeAQDeqHkc\\AP8lSl0d6VwBCQ\\kICtw75iUSE4jdT.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\jeaqdeqhkc\\ap8lsl0d6vwbcq\\kictw75iuse4jdt.rtf")) returned 0xffffffff [0243.134] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1dd4df0, ftCreationTime.dwHighDateTime=0x1d5c3c0, ftLastAccessTime.dwLowDateTime=0x6f308140, ftLastAccessTime.dwHighDateTime=0x1d5c56b, ftLastWriteTime.dwLowDateTime=0x6f308140, ftLastWriteTime.dwHighDateTime=0x1d5c56b, nFileSizeHigh=0x0, nFileSizeLow=0x10af6, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="mDJcw8J1YJRg m5r5L.pptx", cAlternateFileName="MDJCW8~1.PPT")) returned 1 [0243.134] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.134] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.134] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.134] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a894, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.134] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.134] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a894) returned 0x10ab [0243.134] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632661e0, ftCreationTime.dwHighDateTime=0x1d5bae3, ftLastAccessTime.dwLowDateTime=0xc1673d40, ftLastAccessTime.dwHighDateTime=0x1d5c292, ftLastWriteTime.dwLowDateTime=0xc1673d40, ftLastWriteTime.dwHighDateTime=0x1d5c292, nFileSizeHigh=0x0, nFileSizeLow=0xf09b, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="wP_gDRBmCyWmSG7.ots", cAlternateFileName="WP_GDR~1.OTS")) returned 1 [0243.135] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.135] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.135] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.135] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a99c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.135] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.135] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a99c) returned 0x10ab [0243.135] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632661e0, ftCreationTime.dwHighDateTime=0x1d5bae3, ftLastAccessTime.dwLowDateTime=0xc1673d40, ftLastAccessTime.dwHighDateTime=0x1d5c292, ftLastWriteTime.dwLowDateTime=0xc1673d40, ftLastWriteTime.dwHighDateTime=0x1d5c292, nFileSizeHigh=0x0, nFileSizeLow=0xf09b, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="wP_gDRBmCyWmSG7.ots", cAlternateFileName="WP_GDR~1.OTS")) returned 0 [0243.135] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0243.135] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf06b0390, ftCreationTime.dwHighDateTime=0x1d5bdd0, ftLastAccessTime.dwLowDateTime=0x25b79350, ftLastAccessTime.dwHighDateTime=0x1d5bc24, ftLastWriteTime.dwLowDateTime=0x25b79350, ftLastWriteTime.dwHighDateTime=0x1d5bc24, nFileSizeHigh=0x0, nFileSizeLow=0xbf38, dwReserved0=0x3747536d, dwReserved1=0x73746f2e, cFileName="ydCYuQ2M.ods", cAlternateFileName="")) returned 1 [0243.136] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.136] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.136] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.136] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa84) returned 0x10ab [0243.136] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf06b0390, ftCreationTime.dwHighDateTime=0x1d5bdd0, ftLastAccessTime.dwLowDateTime=0x25b79350, ftLastAccessTime.dwHighDateTime=0x1d5bc24, ftLastWriteTime.dwLowDateTime=0x25b79350, ftLastWriteTime.dwHighDateTime=0x1d5bc24, nFileSizeHigh=0x0, nFileSizeLow=0xbf38, dwReserved0=0x3747536d, dwReserved1=0x73746f2e, cFileName="ydCYuQ2M.ods", cAlternateFileName="")) returned 0 [0243.136] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0243.136] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafd3650, ftCreationTime.dwHighDateTime=0x1d5bbde, ftLastAccessTime.dwLowDateTime=0xdd7f5790, ftLastAccessTime.dwHighDateTime=0x1d5c447, ftLastWriteTime.dwLowDateTime=0xdd7f5790, ftLastWriteTime.dwHighDateTime=0x1d5c447, nFileSizeHigh=0x0, nFileSizeLow=0xcfdf, dwReserved0=0x514373, dwReserved1=0x18ef8c, cFileName="uPRSRoe8zG3ShJ-MO.xls", cAlternateFileName="UPRSRO~1.XLS")) returned 1 [0243.136] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.136] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.136] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.136] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab58) returned 0x10ab [0243.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\uPRSRoe8zG3ShJ-MO.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\uprsroe8zg3shj-mo.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0243.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\75505253526F65387A473353684A2D4D4F.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\75505253526f65387a473353684a2d4d4f.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0243.137] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcfdf [0243.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0243.138] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0243.218] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcfdf, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xcfdf, lpOverlapped=0x0) returned 1 [0243.220] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xcfe0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xcfe0, lpOverlapped=0x0) returned 1 [0243.223] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.245] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.255] CloseHandle (hObject=0xf0) returned 1 [0243.255] CloseHandle (hObject=0xf8) returned 1 [0243.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\uPRSRoe8zG3ShJ-MO.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\uprsroe8zg3shj-mo.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\75505253526F65387A473353684A2D4D4F.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\75505253526f65387a473353684a2d4d4f.xls")) returned 0 [0243.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\75505253526F65387A473353684A2D4D4F.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\75505253526f65387a473353684a2d4d4f.xls")) returned 0x20 [0243.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\uPRSRoe8zG3ShJ-MO.xls", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafd3650, ftCreationTime.dwHighDateTime=0x1d5bbde, ftLastAccessTime.dwLowDateTime=0xdd7f5790, ftLastAccessTime.dwHighDateTime=0x1d5c447, ftLastWriteTime.dwLowDateTime=0xdd7f5790, ftLastWriteTime.dwHighDateTime=0x1d5c447, nFileSizeHigh=0x0, nFileSizeLow=0xcfdf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uPRSRoe8zG3ShJ-MO.xls", cAlternateFileName="UPRSRO~1.XLS")) returned 0x324fd8 [0243.258] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafd3650, ftCreationTime.dwHighDateTime=0x1d5bbde, ftLastAccessTime.dwLowDateTime=0xdd7f5790, ftLastAccessTime.dwHighDateTime=0x1d5c447, ftLastWriteTime.dwLowDateTime=0xdd7f5790, ftLastWriteTime.dwHighDateTime=0x1d5c447, nFileSizeHigh=0x0, nFileSizeLow=0xcfdf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uPRSRoe8zG3ShJ-MO.xls", cAlternateFileName="UPRSRO~1.XLS")) returned 0 [0243.258] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0243.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\uPRSRoe8zG3ShJ-MO.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\uprsroe8zg3shj-mo.xls")) returned 1 [0243.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\uPRSRoe8zG3ShJ-MO.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\uprsroe8zg3shj-mo.xls")) returned 0xffffffff [0243.260] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e83d6a0, ftCreationTime.dwHighDateTime=0x1d5bb92, ftLastAccessTime.dwLowDateTime=0x574284d0, ftLastAccessTime.dwHighDateTime=0x1d5c407, ftLastWriteTime.dwLowDateTime=0x574284d0, ftLastWriteTime.dwHighDateTime=0x1d5c407, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="us hqSazwMHtMKPW 8", cAlternateFileName="USHQSA~1")) returned 1 [0243.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e83d6a0, ftCreationTime.dwHighDateTime=0x1d5bb92, ftLastAccessTime.dwLowDateTime=0x574284d0, ftLastAccessTime.dwHighDateTime=0x1d5c407, ftLastWriteTime.dwLowDateTime=0x574284d0, ftLastWriteTime.dwHighDateTime=0x1d5c407, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x329f28, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0243.260] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e83d6a0, ftCreationTime.dwHighDateTime=0x1d5bb92, ftLastAccessTime.dwLowDateTime=0x574284d0, ftLastAccessTime.dwHighDateTime=0x1d5c407, ftLastWriteTime.dwLowDateTime=0x574284d0, ftLastWriteTime.dwHighDateTime=0x1d5c407, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x329f28, cFileName="..", cAlternateFileName="")) returned 1 [0243.260] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fb4670, ftCreationTime.dwHighDateTime=0x1d5c33e, ftLastAccessTime.dwLowDateTime=0xdaf16b0, ftLastAccessTime.dwHighDateTime=0x1d5c076, ftLastWriteTime.dwLowDateTime=0xdaf16b0, ftLastWriteTime.dwHighDateTime=0x1d5c076, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x329f28, cFileName="Ifn0s4Jt", cAlternateFileName="")) returned 1 [0243.261] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fb4670, ftCreationTime.dwHighDateTime=0x1d5c33e, ftLastAccessTime.dwLowDateTime=0xdaf16b0, ftLastAccessTime.dwHighDateTime=0x1d5c076, ftLastWriteTime.dwLowDateTime=0xdaf16b0, ftLastWriteTime.dwHighDateTime=0x1d5c076, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x325018 [0243.261] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fb4670, ftCreationTime.dwHighDateTime=0x1d5c33e, ftLastAccessTime.dwLowDateTime=0xdaf16b0, ftLastAccessTime.dwHighDateTime=0x1d5c076, ftLastWriteTime.dwLowDateTime=0xdaf16b0, ftLastWriteTime.dwHighDateTime=0x1d5c076, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0243.261] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a0, ftCreationTime.dwHighDateTime=0x1d5c53c, ftLastAccessTime.dwLowDateTime=0x2d56120, ftLastAccessTime.dwHighDateTime=0x1d5be2a, ftLastWriteTime.dwLowDateTime=0x2d56120, ftLastWriteTime.dwHighDateTime=0x1d5be2a, nFileSizeHigh=0x0, nFileSizeLow=0x9812, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="H7u.docx", cAlternateFileName="H7U~1.DOC")) returned 1 [0243.262] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.262] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.262] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.262] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.262] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.262] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af10) returned 0x10ab [0243.262] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\H7u.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\h7u.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0243.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\483775.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\483775.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0243.264] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9812 [0243.264] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0243.264] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0243.351] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9812, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x9812, lpOverlapped=0x0) returned 1 [0243.352] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x9820, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x9820, lpOverlapped=0x0) returned 1 [0243.354] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.375] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.406] CloseHandle (hObject=0x100) returned 1 [0243.406] CloseHandle (hObject=0xf4) returned 1 [0243.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\H7u.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\h7u.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\483775.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\483775.docx")) returned 0 [0243.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\483775.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\483775.docx")) returned 0x20 [0243.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\H7u.docx", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a0, ftCreationTime.dwHighDateTime=0x1d5c53c, ftLastAccessTime.dwLowDateTime=0x2d56120, ftLastAccessTime.dwHighDateTime=0x1d5be2a, ftLastWriteTime.dwLowDateTime=0x2d56120, ftLastWriteTime.dwHighDateTime=0x1d5be2a, nFileSizeHigh=0x0, nFileSizeLow=0x9812, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="H7u.docx", cAlternateFileName="H7U~1.DOC")) returned 0x325058 [0243.407] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a0, ftCreationTime.dwHighDateTime=0x1d5c53c, ftLastAccessTime.dwLowDateTime=0x2d56120, ftLastAccessTime.dwHighDateTime=0x1d5be2a, ftLastWriteTime.dwLowDateTime=0x2d56120, ftLastWriteTime.dwHighDateTime=0x1d5be2a, nFileSizeHigh=0x0, nFileSizeLow=0x9812, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="H7u.docx", cAlternateFileName="H7U~1.DOC")) returned 0 [0243.407] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0243.407] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\H7u.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\h7u.docx")) returned 1 [0243.409] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\H7u.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\h7u.docx")) returned 0xffffffff [0243.409] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d50af0, ftCreationTime.dwHighDateTime=0x1d5c2c6, ftLastAccessTime.dwLowDateTime=0x2a225410, ftLastAccessTime.dwHighDateTime=0x1d5bafe, ftLastWriteTime.dwLowDateTime=0x2a225410, ftLastWriteTime.dwHighDateTime=0x1d5bafe, nFileSizeHigh=0x0, nFileSizeLow=0x4b5c, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="k5veOf0IesLx.pdf", cAlternateFileName="K5VEOF~1.PDF")) returned 1 [0243.409] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.409] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.409] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.409] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0243.410] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afdc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.410] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.410] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afdc) returned 0x10ab [0243.410] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0243.410] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\k5veOf0IesLx.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\k5veof0ieslx.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0243.410] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\6B3576654F66304965734C78.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\6b3576654f66304965734c78.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0243.411] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b5c [0243.411] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0243.411] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0243.482] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4b5c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x4b5c, lpOverlapped=0x0) returned 1 [0243.483] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x4b60, lpOverlapped=0x0) returned 1 [0243.484] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.506] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.517] CloseHandle (hObject=0xf4) returned 1 [0243.517] CloseHandle (hObject=0x100) returned 1 [0243.517] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\k5veOf0IesLx.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\k5veof0ieslx.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\6B3576654F66304965734C78.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\6b3576654f66304965734c78.pdf")) returned 0 [0243.518] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\6B3576654F66304965734C78.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\6b3576654f66304965734c78.pdf")) returned 0x20 [0243.518] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\k5veOf0IesLx.pdf", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d50af0, ftCreationTime.dwHighDateTime=0x1d5c2c6, ftLastAccessTime.dwLowDateTime=0x2a225410, ftLastAccessTime.dwHighDateTime=0x1d5bafe, ftLastWriteTime.dwLowDateTime=0x2a225410, ftLastWriteTime.dwHighDateTime=0x1d5bafe, nFileSizeHigh=0x0, nFileSizeLow=0x4b5c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="k5veOf0IesLx.pdf", cAlternateFileName="K5VEOF~1.PDF")) returned 0x325058 [0243.518] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d50af0, ftCreationTime.dwHighDateTime=0x1d5c2c6, ftLastAccessTime.dwLowDateTime=0x2a225410, ftLastAccessTime.dwHighDateTime=0x1d5bafe, ftLastWriteTime.dwLowDateTime=0x2a225410, ftLastWriteTime.dwHighDateTime=0x1d5bafe, nFileSizeHigh=0x0, nFileSizeLow=0x4b5c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="k5veOf0IesLx.pdf", cAlternateFileName="K5VEOF~1.PDF")) returned 0 [0243.518] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0243.518] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\k5veOf0IesLx.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\k5veof0ieslx.pdf")) returned 1 [0243.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\k5veOf0IesLx.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\k5veof0ieslx.pdf")) returned 0xffffffff [0243.520] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb793a560, ftCreationTime.dwHighDateTime=0x1d5b7e8, ftLastAccessTime.dwLowDateTime=0x184e4e60, ftLastAccessTime.dwHighDateTime=0x1d5c01c, ftLastWriteTime.dwLowDateTime=0x184e4e60, ftLastWriteTime.dwHighDateTime=0x1d5c01c, nFileSizeHigh=0x0, nFileSizeLow=0xe41e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="sNHhIvTa5j1Q.csv", cAlternateFileName="SNHHIV~1.CSV")) returned 1 [0243.521] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.521] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0243.521] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.521] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.521] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0243.521] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0243.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\sNHhIvTa5j1Q.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\snhhivta5j1q.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0243.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\734E486849765461356A3151.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\734e486849765461356a3151.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0243.522] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe41e [0243.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0243.523] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0243.629] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe41e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xe41e, lpOverlapped=0x0) returned 1 [0243.631] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe420, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xe420, lpOverlapped=0x0) returned 1 [0243.632] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.655] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.679] CloseHandle (hObject=0x100) returned 1 [0243.679] CloseHandle (hObject=0xf4) returned 1 [0243.679] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\sNHhIvTa5j1Q.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\snhhivta5j1q.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\734E486849765461356A3151.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\734e486849765461356a3151.csv")) returned 0 [0243.681] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\734E486849765461356A3151.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\734e486849765461356a3151.csv")) returned 0x20 [0243.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\sNHhIvTa5j1Q.csv", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb793a560, ftCreationTime.dwHighDateTime=0x1d5b7e8, ftLastAccessTime.dwLowDateTime=0x184e4e60, ftLastAccessTime.dwHighDateTime=0x1d5c01c, ftLastWriteTime.dwLowDateTime=0x184e4e60, ftLastWriteTime.dwHighDateTime=0x1d5c01c, nFileSizeHigh=0x0, nFileSizeLow=0xe41e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sNHhIvTa5j1Q.csv", cAlternateFileName="SNHHIV~1.CSV")) returned 0x325058 [0243.681] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb793a560, ftCreationTime.dwHighDateTime=0x1d5b7e8, ftLastAccessTime.dwLowDateTime=0x184e4e60, ftLastAccessTime.dwHighDateTime=0x1d5c01c, ftLastWriteTime.dwLowDateTime=0x184e4e60, ftLastWriteTime.dwHighDateTime=0x1d5c01c, nFileSizeHigh=0x0, nFileSizeLow=0xe41e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sNHhIvTa5j1Q.csv", cAlternateFileName="SNHHIV~1.CSV")) returned 0 [0243.681] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0243.681] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\sNHhIvTa5j1Q.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\snhhivta5j1q.csv")) returned 1 [0243.682] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Ifn0s4Jt\\sNHhIvTa5j1Q.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\ifn0s4jt\\snhhivta5j1q.csv")) returned 0xffffffff [0243.683] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb793a560, ftCreationTime.dwHighDateTime=0x1d5b7e8, ftLastAccessTime.dwLowDateTime=0x184e4e60, ftLastAccessTime.dwHighDateTime=0x1d5c01c, ftLastWriteTime.dwLowDateTime=0x184e4e60, ftLastWriteTime.dwHighDateTime=0x1d5c01c, nFileSizeHigh=0x0, nFileSizeLow=0xe41e, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="sNHhIvTa5j1Q.csv", cAlternateFileName="SNHHIV~1.CSV")) returned 0 [0243.683] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0243.683] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb765dac0, ftCreationTime.dwHighDateTime=0x1d5c532, ftLastAccessTime.dwLowDateTime=0xccd29e50, ftLastAccessTime.dwHighDateTime=0x1d5bdf5, ftLastWriteTime.dwLowDateTime=0xccd29e50, ftLastWriteTime.dwHighDateTime=0x1d5bdf5, nFileSizeHigh=0x0, nFileSizeLow=0xce9, dwReserved0=0x73632e51, dwReserved1=0x329f76, cFileName="qajg5MIpIcbVTzO- L.docx", cAlternateFileName="QAJG5M~1.DOC")) returned 1 [0243.683] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.683] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.683] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.683] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a364, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.683] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.684] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a364) returned 0x10ab [0243.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\qajg5MIpIcbVTzO- L.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\qajg5mipicbvtzo- l.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0243.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\71616A67354D497049636256547A4F2D204C.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\71616a67354d497049636256547a4f2d204c.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0243.685] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce9 [0243.685] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0243.685] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0243.785] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xce9, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xce9, lpOverlapped=0x0) returned 1 [0243.785] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xcf0, lpOverlapped=0x0) returned 1 [0243.786] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.809] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.819] CloseHandle (hObject=0xf0) returned 1 [0243.819] CloseHandle (hObject=0xf4) returned 1 [0243.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\qajg5MIpIcbVTzO- L.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\qajg5mipicbvtzo- l.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\71616A67354D497049636256547A4F2D204C.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\71616a67354d497049636256547a4f2d204c.docx")) returned 0 [0243.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\71616A67354D497049636256547A4F2D204C.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\71616a67354d497049636256547a4f2d204c.docx")) returned 0x20 [0243.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\qajg5MIpIcbVTzO- L.docx", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb765dac0, ftCreationTime.dwHighDateTime=0x1d5c532, ftLastAccessTime.dwLowDateTime=0xccd29e50, ftLastAccessTime.dwHighDateTime=0x1d5bdf5, ftLastWriteTime.dwLowDateTime=0xccd29e50, ftLastWriteTime.dwHighDateTime=0x1d5bdf5, nFileSizeHigh=0x0, nFileSizeLow=0xce9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qajg5MIpIcbVTzO- L.docx", cAlternateFileName="QAJG5M~1.DOC")) returned 0x325018 [0243.821] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb765dac0, ftCreationTime.dwHighDateTime=0x1d5c532, ftLastAccessTime.dwLowDateTime=0xccd29e50, ftLastAccessTime.dwHighDateTime=0x1d5bdf5, ftLastWriteTime.dwLowDateTime=0xccd29e50, ftLastWriteTime.dwHighDateTime=0x1d5bdf5, nFileSizeHigh=0x0, nFileSizeLow=0xce9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qajg5MIpIcbVTzO- L.docx", cAlternateFileName="QAJG5M~1.DOC")) returned 0 [0243.821] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0243.821] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\qajg5MIpIcbVTzO- L.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\qajg5mipicbvtzo- l.docx")) returned 1 [0243.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\qajg5MIpIcbVTzO- L.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\qajg5mipicbvtzo- l.docx")) returned 0xffffffff [0243.822] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae0b8c20, ftCreationTime.dwHighDateTime=0x1d5c01b, ftLastAccessTime.dwLowDateTime=0xc7c0cfb0, ftLastAccessTime.dwHighDateTime=0x1d5ba5b, ftLastWriteTime.dwLowDateTime=0xc7c0cfb0, ftLastWriteTime.dwHighDateTime=0x1d5ba5b, nFileSizeHigh=0x0, nFileSizeLow=0xfe51, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="y7yT.ots", cAlternateFileName="")) returned 1 [0243.823] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.823] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.823] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.823] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a7e8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.823] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.823] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a7e8) returned 0x10ab [0243.824] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930cddf0, ftCreationTime.dwHighDateTime=0x1d5bcee, ftLastAccessTime.dwLowDateTime=0x80a94480, ftLastAccessTime.dwHighDateTime=0x1d5b76e, ftLastWriteTime.dwLowDateTime=0x80a94480, ftLastWriteTime.dwHighDateTime=0x1d5b76e, nFileSizeHigh=0x0, nFileSizeLow=0x18de0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Zz_jtEUlhSu_IKW3L.docx", cAlternateFileName="ZZ_JTE~1.DOC")) returned 1 [0243.824] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.824] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.824] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.824] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a8ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.824] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.824] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a8ac) returned 0x10ab [0243.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Zz_jtEUlhSu_IKW3L.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\zz_jteulhsu_ikw3l.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0243.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\5A7A5F6A7445556C6853755F494B57334C.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\5a7a5f6a7445556c6853755f494b57334c.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0243.825] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18de0 [0243.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0243.826] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0243.898] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18de0, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x18de0, lpOverlapped=0x0) returned 1 [0243.901] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18df0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x18df0, lpOverlapped=0x0) returned 1 [0243.903] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.927] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.938] CloseHandle (hObject=0xf4) returned 1 [0243.938] CloseHandle (hObject=0xf0) returned 1 [0243.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Zz_jtEUlhSu_IKW3L.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\zz_jteulhsu_ikw3l.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\5A7A5F6A7445556C6853755F494B57334C.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\5a7a5f6a7445556c6853755f494b57334c.docx")) returned 0 [0243.939] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\5A7A5F6A7445556C6853755F494B57334C.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\5a7a5f6a7445556c6853755f494b57334c.docx")) returned 0x20 [0243.939] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Zz_jtEUlhSu_IKW3L.docx", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930cddf0, ftCreationTime.dwHighDateTime=0x1d5bcee, ftLastAccessTime.dwLowDateTime=0x80a94480, ftLastAccessTime.dwHighDateTime=0x1d5b76e, ftLastWriteTime.dwLowDateTime=0x80a94480, ftLastWriteTime.dwHighDateTime=0x1d5b76e, nFileSizeHigh=0x0, nFileSizeLow=0x18de0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Zz_jtEUlhSu_IKW3L.docx", cAlternateFileName="ZZ_JTE~1.DOC")) returned 0x325018 [0243.939] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930cddf0, ftCreationTime.dwHighDateTime=0x1d5bcee, ftLastAccessTime.dwLowDateTime=0x80a94480, ftLastAccessTime.dwHighDateTime=0x1d5b76e, ftLastWriteTime.dwLowDateTime=0x80a94480, ftLastWriteTime.dwHighDateTime=0x1d5b76e, nFileSizeHigh=0x0, nFileSizeLow=0x18de0, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Zz_jtEUlhSu_IKW3L.docx", cAlternateFileName="ZZ_JTE~1.DOC")) returned 0 [0243.939] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0243.939] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Zz_jtEUlhSu_IKW3L.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\zz_jteulhsu_ikw3l.docx")) returned 1 [0243.941] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\epGfDJqj\\YZy1uEfpD3CWNcpqF\\us hqSazwMHtMKPW 8\\Zz_jtEUlhSu_IKW3L.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\epgfdjqj\\yzy1uefpd3cwncpqf\\us hqsazwmhtmkpw 8\\zz_jteulhsu_ikw3l.docx")) returned 0xffffffff [0243.941] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930cddf0, ftCreationTime.dwHighDateTime=0x1d5bcee, ftLastAccessTime.dwLowDateTime=0x80a94480, ftLastAccessTime.dwHighDateTime=0x1d5b76e, ftLastWriteTime.dwLowDateTime=0x80a94480, ftLastWriteTime.dwHighDateTime=0x1d5b76e, nFileSizeHigh=0x0, nFileSizeLow=0x18de0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="Zz_jtEUlhSu_IKW3L.docx", cAlternateFileName="ZZ_JTE~1.DOC")) returned 0 [0243.941] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0243.941] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e83d6a0, ftCreationTime.dwHighDateTime=0x1d5bb92, ftLastAccessTime.dwLowDateTime=0x574284d0, ftLastAccessTime.dwHighDateTime=0x1d5c407, ftLastWriteTime.dwLowDateTime=0x574284d0, ftLastWriteTime.dwHighDateTime=0x1d5c407, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="us hqSazwMHtMKPW 8", cAlternateFileName="USHQSA~1")) returned 0 [0243.941] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0243.941] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13c81500, ftCreationTime.dwHighDateTime=0x1d5c374, ftLastAccessTime.dwLowDateTime=0xcf0b7ec0, ftLastAccessTime.dwHighDateTime=0x1d5b84c, ftLastWriteTime.dwLowDateTime=0xcf0b7ec0, ftLastWriteTime.dwHighDateTime=0x1d5b84c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="YZy1uEfpD3CWNcpqF", cAlternateFileName="YZY1UE~1")) returned 0 [0243.941] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0243.941] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50507d10, ftCreationTime.dwHighDateTime=0x1d55f8c, ftLastAccessTime.dwLowDateTime=0xe501bef0, ftLastAccessTime.dwHighDateTime=0x1d56663, ftLastWriteTime.dwLowDateTime=0xe501bef0, ftLastWriteTime.dwHighDateTime=0x1d56663, nFileSizeHigh=0x0, nFileSizeLow=0x162ed, dwReserved0=0x70634e57, dwReserved1=0x77584671, cFileName="gCAt8.docx", cAlternateFileName="GCAT8~1.DOC")) returned 1 [0243.942] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0243.942] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.942] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0243.942] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291ec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0243.942] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0243.942] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291ec) returned 0x10ab [0243.942] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gCAt8.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gcat8.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0243.942] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6743417438.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6743417438.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0243.943] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x162ed [0243.943] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0243.944] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0244.030] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x162ed, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x162ed, lpOverlapped=0x0) returned 1 [0244.033] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x162f0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x162f0, lpOverlapped=0x0) returned 1 [0244.035] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.057] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.067] CloseHandle (hObject=0x10c) returned 1 [0244.067] CloseHandle (hObject=0xfc) returned 1 [0244.067] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gCAt8.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gcat8.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6743417438.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6743417438.docx")) returned 0 [0244.068] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6743417438.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6743417438.docx")) returned 0x20 [0244.068] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gCAt8.docx", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50507d10, ftCreationTime.dwHighDateTime=0x1d55f8c, ftLastAccessTime.dwLowDateTime=0xe501bef0, ftLastAccessTime.dwHighDateTime=0x1d56663, ftLastWriteTime.dwLowDateTime=0xe501bef0, ftLastWriteTime.dwHighDateTime=0x1d56663, nFileSizeHigh=0x0, nFileSizeLow=0x162ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="gCAt8.docx", cAlternateFileName="GCAT8~1.DOC")) returned 0x324f58 [0244.068] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50507d10, ftCreationTime.dwHighDateTime=0x1d55f8c, ftLastAccessTime.dwLowDateTime=0xe501bef0, ftLastAccessTime.dwHighDateTime=0x1d56663, ftLastWriteTime.dwLowDateTime=0xe501bef0, ftLastWriteTime.dwHighDateTime=0x1d56663, nFileSizeHigh=0x0, nFileSizeLow=0x162ed, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="gCAt8.docx", cAlternateFileName="GCAT8~1.DOC")) returned 0 [0244.068] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0244.068] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gCAt8.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gcat8.docx")) returned 1 [0244.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gCAt8.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gcat8.docx")) returned 0xffffffff [0244.070] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca53170, ftCreationTime.dwHighDateTime=0x1d555b2, ftLastAccessTime.dwLowDateTime=0x7b9b0310, ftLastAccessTime.dwHighDateTime=0x1d56f9e, ftLastWriteTime.dwLowDateTime=0x7b9b0310, ftLastWriteTime.dwHighDateTime=0x1d56f9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a6f, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="HsooFVdcAyW_RW.xlsx", cAlternateFileName="HSOOFV~1.XLS")) returned 1 [0244.071] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.071] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.071] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.071] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c293f8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.071] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.071] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c293f8) returned 0x10ab [0244.071] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f524120, ftCreationTime.dwHighDateTime=0x1d5b5db, ftLastAccessTime.dwLowDateTime=0x934fbde0, ftLastAccessTime.dwHighDateTime=0x1d5406c, ftLastWriteTime.dwLowDateTime=0x934fbde0, ftLastWriteTime.dwHighDateTime=0x1d5406c, nFileSizeHigh=0x0, nFileSizeLow=0x5525, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Hu0M4XwKGRbpnH.xlsx", cAlternateFileName="HU0M4X~1.XLS")) returned 1 [0244.071] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.072] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.072] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.072] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a95c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.072] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.072] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a95c) returned 0x10ab [0244.072] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb985e320, ftCreationTime.dwHighDateTime=0x1d56d23, ftLastAccessTime.dwLowDateTime=0x27476750, ftLastAccessTime.dwHighDateTime=0x1d5658e, ftLastWriteTime.dwLowDateTime=0x27476750, ftLastWriteTime.dwHighDateTime=0x1d5658e, nFileSizeHigh=0x0, nFileSizeLow=0x8ca9, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="jdLJ8ERzrO7p5 F.xlsx", cAlternateFileName="JDLJ8E~1.XLS")) returned 1 [0244.072] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.072] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.072] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.072] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c293f8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.072] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.072] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c293f8) returned 0x10ab [0244.072] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3080e1b0, ftCreationTime.dwHighDateTime=0x1d5be0e, ftLastAccessTime.dwLowDateTime=0x8e4edfa0, ftLastAccessTime.dwHighDateTime=0x1d5bdbd, ftLastWriteTime.dwLowDateTime=0x8e4edfa0, ftLastWriteTime.dwHighDateTime=0x1d5bdbd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="MBiev-Uf1Xp", cAlternateFileName="MBIEV-~1")) returned 1 [0244.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3080e1b0, ftCreationTime.dwHighDateTime=0x1d5be0e, ftLastAccessTime.dwLowDateTime=0x8e4edfa0, ftLastAccessTime.dwHighDateTime=0x1d5bdbd, ftLastWriteTime.dwLowDateTime=0x8e4edfa0, ftLastWriteTime.dwHighDateTime=0x1d5bdbd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f344, dwReserved1=0x18f344, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0244.073] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3080e1b0, ftCreationTime.dwHighDateTime=0x1d5be0e, ftLastAccessTime.dwLowDateTime=0x8e4edfa0, ftLastAccessTime.dwHighDateTime=0x1d5bdbd, ftLastWriteTime.dwLowDateTime=0x8e4edfa0, ftLastWriteTime.dwHighDateTime=0x1d5bdbd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f344, dwReserved1=0x18f344, cFileName="..", cAlternateFileName="")) returned 1 [0244.073] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2ca16b0, ftCreationTime.dwHighDateTime=0x1d5b638, ftLastAccessTime.dwLowDateTime=0x21ee2c30, ftLastAccessTime.dwHighDateTime=0x1d5c45c, ftLastWriteTime.dwLowDateTime=0x21ee2c30, ftLastWriteTime.dwHighDateTime=0x1d5c45c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f344, dwReserved1=0x18f344, cFileName="16XXq 5rfX", cAlternateFileName="16XXQ5~1")) returned 1 [0244.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2ca16b0, ftCreationTime.dwHighDateTime=0x1d5b638, ftLastAccessTime.dwLowDateTime=0x21ee2c30, ftLastAccessTime.dwHighDateTime=0x1d5c45c, ftLastWriteTime.dwLowDateTime=0x21ee2c30, ftLastWriteTime.dwHighDateTime=0x1d5c45c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0244.073] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2ca16b0, ftCreationTime.dwHighDateTime=0x1d5b638, ftLastAccessTime.dwLowDateTime=0x21ee2c30, ftLastAccessTime.dwHighDateTime=0x1d5c45c, ftLastWriteTime.dwLowDateTime=0x21ee2c30, ftLastWriteTime.dwHighDateTime=0x1d5c45c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0244.073] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0adecf0, ftCreationTime.dwHighDateTime=0x1d5bf17, ftLastAccessTime.dwLowDateTime=0x60f05800, ftLastAccessTime.dwHighDateTime=0x1d5bca4, ftLastWriteTime.dwLowDateTime=0x60f05800, ftLastWriteTime.dwHighDateTime=0x1d5bca4, nFileSizeHigh=0x0, nFileSizeLow=0xb5a2, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="ab48R1oYXYyDTLB_.pps", cAlternateFileName="AB48R1~1.PPS")) returned 1 [0244.073] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.073] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.073] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.073] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a970, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.073] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.073] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a970) returned 0x10ab [0244.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\ab48R1oYXYyDTLB_.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\16xxq 5rfx\\ab48r1oyxyydtlb_.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0244.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\6162343852316F5958597944544C425F.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\16xxq 5rfx\\6162343852316f5958597944544c425f.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0244.076] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5a2 [0244.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0244.077] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0244.162] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb5a2, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xb5a2, lpOverlapped=0x0) returned 1 [0244.164] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xb5b0, lpOverlapped=0x0) returned 1 [0244.165] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.187] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.198] CloseHandle (hObject=0xf8) returned 1 [0244.198] CloseHandle (hObject=0xf0) returned 1 [0244.198] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\ab48R1oYXYyDTLB_.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\16xxq 5rfx\\ab48r1oyxyydtlb_.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\6162343852316F5958597944544C425F.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\16xxq 5rfx\\6162343852316f5958597944544c425f.pps")) returned 0 [0244.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\6162343852316F5958597944544C425F.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\16xxq 5rfx\\6162343852316f5958597944544c425f.pps")) returned 0x20 [0244.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\ab48R1oYXYyDTLB_.pps", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0adecf0, ftCreationTime.dwHighDateTime=0x1d5bf17, ftLastAccessTime.dwLowDateTime=0x60f05800, ftLastAccessTime.dwHighDateTime=0x1d5bca4, ftLastWriteTime.dwLowDateTime=0x60f05800, ftLastWriteTime.dwHighDateTime=0x1d5bca4, nFileSizeHigh=0x0, nFileSizeLow=0xb5a2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ab48R1oYXYyDTLB_.pps", cAlternateFileName="AB48R1~1.PPS")) returned 0x324fd8 [0244.200] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0adecf0, ftCreationTime.dwHighDateTime=0x1d5bf17, ftLastAccessTime.dwLowDateTime=0x60f05800, ftLastAccessTime.dwHighDateTime=0x1d5bca4, ftLastWriteTime.dwLowDateTime=0x60f05800, ftLastWriteTime.dwHighDateTime=0x1d5bca4, nFileSizeHigh=0x0, nFileSizeLow=0xb5a2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ab48R1oYXYyDTLB_.pps", cAlternateFileName="AB48R1~1.PPS")) returned 0 [0244.200] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0244.200] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\ab48R1oYXYyDTLB_.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\16xxq 5rfx\\ab48r1oyxyydtlb_.pps")) returned 1 [0244.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\16XXq 5rfX\\ab48R1oYXYyDTLB_.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\16xxq 5rfx\\ab48r1oyxyydtlb_.pps")) returned 0xffffffff [0244.202] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dea5410, ftCreationTime.dwHighDateTime=0x1d5b58a, ftLastAccessTime.dwLowDateTime=0x313669e0, ftLastAccessTime.dwHighDateTime=0x1d5b71a, ftLastWriteTime.dwLowDateTime=0x313669e0, ftLastWriteTime.dwHighDateTime=0x1d5b71a, nFileSizeHigh=0x0, nFileSizeLow=0x3179, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOhh2MRGXT.pptx", cAlternateFileName="OOHH2M~1.PPT")) returned 1 [0244.203] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.203] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.203] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.203] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29958, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.203] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.203] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29958) returned 0x10ab [0244.203] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dea5410, ftCreationTime.dwHighDateTime=0x1d5b58a, ftLastAccessTime.dwLowDateTime=0x313669e0, ftLastAccessTime.dwHighDateTime=0x1d5b71a, ftLastWriteTime.dwLowDateTime=0x313669e0, ftLastWriteTime.dwHighDateTime=0x1d5b71a, nFileSizeHigh=0x0, nFileSizeLow=0x3179, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOhh2MRGXT.pptx", cAlternateFileName="OOHH2M~1.PPT")) returned 0 [0244.203] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0244.203] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9960b140, ftCreationTime.dwHighDateTime=0x1d5bd4d, ftLastAccessTime.dwLowDateTime=0x32fd4850, ftLastAccessTime.dwHighDateTime=0x1d5bf4b, ftLastWriteTime.dwLowDateTime=0x32fd4850, ftLastWriteTime.dwHighDateTime=0x1d5bf4b, nFileSizeHigh=0x0, nFileSizeLow=0x2d86, dwReserved0=0x78747070, dwReserved1=0x70702e5f, cFileName="Ncz2LXK7bFvUl6.pps", cAlternateFileName="NCZ2LX~1.PPS")) returned 1 [0244.203] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.203] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.203] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.203] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c299b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.203] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.203] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c299b8) returned 0x10ab [0244.204] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\Ncz2LXK7bFvUl6.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\ncz2lxk7bfvul6.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0244.204] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\4E637A324C584B37624676556C36.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\4e637a324c584b37624676556c36.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0244.205] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d86 [0244.205] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0244.205] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0244.296] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2d86, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x2d86, lpOverlapped=0x0) returned 1 [0244.298] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x2d90, lpOverlapped=0x0) returned 1 [0244.300] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.322] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.333] CloseHandle (hObject=0x10c) returned 1 [0244.333] CloseHandle (hObject=0xf0) returned 1 [0244.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\Ncz2LXK7bFvUl6.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\ncz2lxk7bfvul6.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\4E637A324C584B37624676556C36.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\4e637a324c584b37624676556c36.pps")) returned 0 [0244.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\4E637A324C584B37624676556C36.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\4e637a324c584b37624676556c36.pps")) returned 0x20 [0244.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\Ncz2LXK7bFvUl6.pps", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9960b140, ftCreationTime.dwHighDateTime=0x1d5bd4d, ftLastAccessTime.dwLowDateTime=0x32fd4850, ftLastAccessTime.dwHighDateTime=0x1d5bf4b, ftLastWriteTime.dwLowDateTime=0x32fd4850, ftLastWriteTime.dwHighDateTime=0x1d5bf4b, nFileSizeHigh=0x0, nFileSizeLow=0x2d86, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Ncz2LXK7bFvUl6.pps", cAlternateFileName="NCZ2LX~1.PPS")) returned 0x324f98 [0244.336] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9960b140, ftCreationTime.dwHighDateTime=0x1d5bd4d, ftLastAccessTime.dwLowDateTime=0x32fd4850, ftLastAccessTime.dwHighDateTime=0x1d5bf4b, ftLastWriteTime.dwLowDateTime=0x32fd4850, ftLastWriteTime.dwHighDateTime=0x1d5bf4b, nFileSizeHigh=0x0, nFileSizeLow=0x2d86, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Ncz2LXK7bFvUl6.pps", cAlternateFileName="NCZ2LX~1.PPS")) returned 0 [0244.336] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0244.336] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\Ncz2LXK7bFvUl6.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\ncz2lxk7bfvul6.pps")) returned 1 [0244.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\Ncz2LXK7bFvUl6.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\ncz2lxk7bfvul6.pps")) returned 0xffffffff [0244.338] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615fc260, ftCreationTime.dwHighDateTime=0x1d5bcf6, ftLastAccessTime.dwLowDateTime=0xef74d750, ftLastAccessTime.dwHighDateTime=0x1d5b9ec, ftLastWriteTime.dwLowDateTime=0xef74d750, ftLastWriteTime.dwHighDateTime=0x1d5b9ec, nFileSizeHigh=0x0, nFileSizeLow=0x1171c, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="q403s_jhOF.rtf", cAlternateFileName="Q403S_~1.RTF")) returned 1 [0244.338] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.338] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.338] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.339] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d2c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.339] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.339] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d2c) returned 0x10ab [0244.339] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\q403s_jhOF.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\q403s_jhof.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0244.339] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\71343033735F6A684F46.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\71343033735f6a684f46.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0244.340] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1171c [0244.340] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0244.340] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0244.421] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1171c, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x1171c, lpOverlapped=0x0) returned 1 [0244.423] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11720, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x11720, lpOverlapped=0x0) returned 1 [0244.425] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.447] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.458] CloseHandle (hObject=0xf0) returned 1 [0244.458] CloseHandle (hObject=0x10c) returned 1 [0244.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\q403s_jhOF.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\q403s_jhof.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\71343033735F6A684F46.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\71343033735f6a684f46.rtf")) returned 0 [0244.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\71343033735F6A684F46.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\71343033735f6a684f46.rtf")) returned 0x20 [0244.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\q403s_jhOF.rtf", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615fc260, ftCreationTime.dwHighDateTime=0x1d5bcf6, ftLastAccessTime.dwLowDateTime=0xef74d750, ftLastAccessTime.dwHighDateTime=0x1d5b9ec, ftLastWriteTime.dwLowDateTime=0xef74d750, ftLastWriteTime.dwHighDateTime=0x1d5b9ec, nFileSizeHigh=0x0, nFileSizeLow=0x1171c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="q403s_jhOF.rtf", cAlternateFileName="Q403S_~1.RTF")) returned 0x324f98 [0244.460] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615fc260, ftCreationTime.dwHighDateTime=0x1d5bcf6, ftLastAccessTime.dwLowDateTime=0xef74d750, ftLastAccessTime.dwHighDateTime=0x1d5b9ec, ftLastWriteTime.dwLowDateTime=0xef74d750, ftLastWriteTime.dwHighDateTime=0x1d5b9ec, nFileSizeHigh=0x0, nFileSizeLow=0x1171c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="q403s_jhOF.rtf", cAlternateFileName="Q403S_~1.RTF")) returned 0 [0244.460] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0244.460] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\q403s_jhOF.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\q403s_jhof.rtf")) returned 1 [0244.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\q403s_jhOF.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\q403s_jhof.rtf")) returned 0xffffffff [0244.462] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2cb850, ftCreationTime.dwHighDateTime=0x1d5b8d8, ftLastAccessTime.dwLowDateTime=0x616ab510, ftLastAccessTime.dwHighDateTime=0x1d5bb18, ftLastWriteTime.dwLowDateTime=0x616ab510, ftLastWriteTime.dwHighDateTime=0x1d5bb18, nFileSizeHigh=0x0, nFileSizeLow=0x135ef, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="t2b_.pdf", cAlternateFileName="")) returned 1 [0244.463] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.463] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.463] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.463] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a034, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.463] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.463] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a034) returned 0x10ab [0244.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\t2b_.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\t2b_.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0244.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\7432625F.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\7432625f.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0244.464] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135ef [0244.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0244.464] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0244.555] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x135ef, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x135ef, lpOverlapped=0x0) returned 1 [0244.557] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x135f0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x135f0, lpOverlapped=0x0) returned 1 [0244.559] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.581] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.599] CloseHandle (hObject=0x10c) returned 1 [0244.599] CloseHandle (hObject=0xf0) returned 1 [0244.599] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\t2b_.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\t2b_.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\7432625F.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\7432625f.pdf")) returned 0 [0244.600] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\7432625F.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\7432625f.pdf")) returned 0x20 [0244.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\t2b_.pdf", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2cb850, ftCreationTime.dwHighDateTime=0x1d5b8d8, ftLastAccessTime.dwLowDateTime=0x616ab510, ftLastAccessTime.dwHighDateTime=0x1d5bb18, ftLastWriteTime.dwLowDateTime=0x616ab510, ftLastWriteTime.dwHighDateTime=0x1d5bb18, nFileSizeHigh=0x0, nFileSizeLow=0x135ef, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="t2b_.pdf", cAlternateFileName="")) returned 0x324f98 [0244.600] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2cb850, ftCreationTime.dwHighDateTime=0x1d5b8d8, ftLastAccessTime.dwLowDateTime=0x616ab510, ftLastAccessTime.dwHighDateTime=0x1d5bb18, ftLastWriteTime.dwLowDateTime=0x616ab510, ftLastWriteTime.dwHighDateTime=0x1d5bb18, nFileSizeHigh=0x0, nFileSizeLow=0x135ef, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="t2b_.pdf", cAlternateFileName="")) returned 0 [0244.600] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0244.600] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\t2b_.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\t2b_.pdf")) returned 1 [0244.602] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MBiev-Uf1Xp\\t2b_.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbiev-uf1xp\\t2b_.pdf")) returned 0xffffffff [0244.602] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2cb850, ftCreationTime.dwHighDateTime=0x1d5b8d8, ftLastAccessTime.dwLowDateTime=0x616ab510, ftLastAccessTime.dwHighDateTime=0x1d5bb18, ftLastWriteTime.dwLowDateTime=0x616ab510, ftLastWriteTime.dwHighDateTime=0x1d5bb18, nFileSizeHigh=0x0, nFileSizeLow=0x135ef, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="t2b_.pdf", cAlternateFileName="")) returned 0 [0244.602] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0244.602] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x737070, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0244.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2cb850, ftCreationTime.dwHighDateTime=0x1d5b8d8, ftLastAccessTime.dwLowDateTime=0x616ab510, ftLastAccessTime.dwHighDateTime=0x1d5bb18, ftLastWriteTime.dwLowDateTime=0x616ab510, ftLastWriteTime.dwHighDateTime=0x1d5bb18, nFileSizeHigh=0x0, nFileSizeLow=0x135ef, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="t2b_.pdf", cAlternateFileName="\x18O2")) returned 0xffffffff [0244.602] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x737070, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0244.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2cb850, ftCreationTime.dwHighDateTime=0x1d5b8d8, ftLastAccessTime.dwLowDateTime=0x616ab510, ftLastAccessTime.dwHighDateTime=0x1d5bb18, ftLastWriteTime.dwLowDateTime=0x616ab510, ftLastWriteTime.dwHighDateTime=0x1d5bb18, nFileSizeHigh=0x0, nFileSizeLow=0x135ef, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="t2b_.pdf", cAlternateFileName="\x18O2")) returned 0xffffffff [0244.602] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x737070, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0244.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0244.604] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="..", cAlternateFileName="")) returned 1 [0244.604] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0244.605] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.605] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.605] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.605] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a278, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.605] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.605] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a278) returned 0x10ab [0244.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0244.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0244.608] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0244.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0244.608] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0244.678] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xd8, lpOverlapped=0x0) returned 1 [0244.679] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xe0, lpOverlapped=0x0) returned 1 [0244.680] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.702] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.713] CloseHandle (hObject=0xf0) returned 1 [0244.713] CloseHandle (hObject=0x10c) returned 1 [0244.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\6465736b746f70.ini")) returned 0 [0244.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\6465736b746f70.ini")) returned 0x20 [0244.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f98 [0244.714] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0244.714] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0244.714] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini")) returned 1 [0244.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini")) returned 0xffffffff [0244.715] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0244.716] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.716] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.716] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28f84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.716] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.716] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28f84) returned 0x10ab [0244.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0244.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\4661766F7269746573.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\4661766f7269746573.vss"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0244.718] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0244.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0244.718] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0244.847] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\4661766F7269746573.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\4661766f7269746573.vss")) returned 0 [0244.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\4661766F7269746573.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\4661766f7269746573.vss")) returned 0x20 [0244.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 0x324f98 [0244.849] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 0 [0244.849] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0244.849] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss")) returned 1 [0244.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss")) returned 0xffffffff [0244.849] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="_private", cAlternateFileName="")) returned 1 [0244.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80007e, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0244.853] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80007e, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0244.853] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x80007e, dwReserved1=0x31c7b8, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0244.854] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.854] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.854] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.854] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2c4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.854] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.854] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2c4) returned 0x10ab [0244.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0244.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\666F6C646572.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\666f6c646572.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0244.856] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x74e6 [0244.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0244.856] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0244.944] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x74e6, lpOverlapped=0x0) returned 1 [0244.948] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x74f0, lpOverlapped=0x0) returned 1 [0244.949] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.971] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.982] CloseHandle (hObject=0x10c) returned 1 [0244.982] CloseHandle (hObject=0xf8) returned 1 [0244.982] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\666F6C646572.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\666f6c646572.ico")) returned 0 [0244.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\666F6C646572.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\666f6c646572.ico")) returned 0x20 [0244.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="folder.ico", cAlternateFileName="")) returned 0x324fd8 [0244.984] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0244.984] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0244.984] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0244.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico")) returned 0xffffffff [0244.985] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x80007e, dwReserved1=0x31c7b8, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0244.985] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0244.985] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="_private", cAlternateFileName="")) returned 0 [0244.985] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0244.985] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x737070, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0244.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="_private", cAlternateFileName="\x18O2")) returned 0xffffffff [0244.985] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c032b80, ftCreationTime.dwHighDateTime=0x1d5ba20, ftLastAccessTime.dwLowDateTime=0x71b11370, ftLastAccessTime.dwHighDateTime=0x1d5a7e4, ftLastWriteTime.dwLowDateTime=0x71b11370, ftLastWriteTime.dwHighDateTime=0x1d5a7e4, nFileSizeHigh=0x0, nFileSizeLow=0x12a37, dwReserved0=0xa0000003, dwReserved1=0x737070, cFileName="oFcQA_k0GGF.docx", cAlternateFileName="OFCQA_~1.DOC")) returned 1 [0244.986] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0244.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0244.986] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28d38, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0244.986] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0244.986] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28d38) returned 0x10ab [0244.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oFcQA_k0GGF.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ofcqa_k0ggf.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0244.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6F466351415F6B30474746.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6f466351415f6b30474746.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0244.987] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12a37 [0244.987] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0244.988] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0245.075] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12a37, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x12a37, lpOverlapped=0x0) returned 1 [0245.077] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12a40, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x12a40, lpOverlapped=0x0) returned 1 [0245.079] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.102] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.113] CloseHandle (hObject=0xfc) returned 1 [0245.113] CloseHandle (hObject=0xf0) returned 1 [0245.113] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oFcQA_k0GGF.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ofcqa_k0ggf.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6F466351415F6B30474746.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6f466351415f6b30474746.docx")) returned 0 [0245.114] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6F466351415F6B30474746.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6f466351415f6b30474746.docx")) returned 0x20 [0245.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oFcQA_k0GGF.docx", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c032b80, ftCreationTime.dwHighDateTime=0x1d5ba20, ftLastAccessTime.dwLowDateTime=0x71b11370, ftLastAccessTime.dwHighDateTime=0x1d5a7e4, ftLastWriteTime.dwLowDateTime=0x71b11370, ftLastWriteTime.dwHighDateTime=0x1d5a7e4, nFileSizeHigh=0x0, nFileSizeLow=0x12a37, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="oFcQA_k0GGF.docx", cAlternateFileName="OFCQA_~1.DOC")) returned 0x324f58 [0245.114] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c032b80, ftCreationTime.dwHighDateTime=0x1d5ba20, ftLastAccessTime.dwLowDateTime=0x71b11370, ftLastAccessTime.dwHighDateTime=0x1d5a7e4, ftLastWriteTime.dwLowDateTime=0x71b11370, ftLastWriteTime.dwHighDateTime=0x1d5a7e4, nFileSizeHigh=0x0, nFileSizeLow=0x12a37, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="oFcQA_k0GGF.docx", cAlternateFileName="OFCQA_~1.DOC")) returned 0 [0245.114] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0245.114] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oFcQA_k0GGF.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ofcqa_k0ggf.docx")) returned 1 [0245.116] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oFcQA_k0GGF.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ofcqa_k0ggf.docx")) returned 0xffffffff [0245.116] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52626be0, ftCreationTime.dwHighDateTime=0x1d5b5a9, ftLastAccessTime.dwLowDateTime=0xc2deacc0, ftLastAccessTime.dwHighDateTime=0x1d54fac, ftLastWriteTime.dwLowDateTime=0xc2deacc0, ftLastWriteTime.dwHighDateTime=0x1d54fac, nFileSizeHigh=0x0, nFileSizeLow=0x2825, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFXakhyrmuuC1X.pptx", cAlternateFileName="OFXAKH~1.PPT")) returned 1 [0245.117] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.117] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28f74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28f74) returned 0x10ab [0245.117] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0245.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f344, dwReserved1=0x18f344, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0245.118] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f344, dwReserved1=0x18f344, cFileName="..", cAlternateFileName="")) returned 1 [0245.118] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x18f344, dwReserved1=0x18f344, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0245.118] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.118] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.118] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.118] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c290a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.118] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.118] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c290a4) returned 0x10ab [0245.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0245.119] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\766F65696D6440646A68726575752E756864.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\766f65696d6440646a68726575752e756864.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.120] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42400 [0245.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0245.120] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0245.205] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x42400, lpOverlapped=0x0) returned 1 [0245.214] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x42410, lpOverlapped=0x0) returned 1 [0245.221] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.246] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.258] CloseHandle (hObject=0xfc) returned 1 [0245.258] CloseHandle (hObject=0xf8) returned 1 [0245.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\766F65696D6440646A68726575752E756864.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\766f65696d6440646a68726575752e756864.pst")) returned 0 [0245.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\766F65696D6440646A68726575752E756864.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\766f65696d6440646a68726575752e756864.pst")) returned 0x20 [0245.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0x324f98 [0245.259] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0245.259] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0245.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 1 [0245.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 0xffffffff [0245.262] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x18f344, dwReserved1=0x18f344, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0245.262] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0245.263] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8822ce50, ftCreationTime.dwHighDateTime=0x1d5b829, ftLastAccessTime.dwLowDateTime=0xb3be0770, ftLastAccessTime.dwHighDateTime=0x1d5b697, ftLastWriteTime.dwLowDateTime=0xb3be0770, ftLastWriteTime.dwHighDateTime=0x1d5b697, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="QPlC3MrxDxBoh_nGWn0Q.rtf", cAlternateFileName="QPLC3M~1.RTF")) returned 1 [0245.263] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.263] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.264] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29448, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29448) returned 0x10ab [0245.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QPlC3MrxDxBoh_nGWn0Q.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qplc3mrxdxboh_ngwn0q.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0245.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\51506C43334D72784478426F685F6E47576E3051.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\51506c43334d72784478426f685f6e47576e3051.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.265] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1274 [0245.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0245.265] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0245.357] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1274, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1274, lpOverlapped=0x0) returned 1 [0245.358] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x1280, lpOverlapped=0x0) returned 1 [0245.359] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.405] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.415] CloseHandle (hObject=0xf0) returned 1 [0245.415] CloseHandle (hObject=0xf8) returned 1 [0245.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QPlC3MrxDxBoh_nGWn0Q.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qplc3mrxdxboh_ngwn0q.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\51506C43334D72784478426F685F6E47576E3051.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\51506c43334d72784478426f685f6e47576e3051.rtf")) returned 0 [0245.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\51506C43334D72784478426F685F6E47576E3051.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\51506c43334d72784478426f685f6e47576e3051.rtf")) returned 0x20 [0245.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QPlC3MrxDxBoh_nGWn0Q.rtf", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8822ce50, ftCreationTime.dwHighDateTime=0x1d5b829, ftLastAccessTime.dwLowDateTime=0xb3be0770, ftLastAccessTime.dwHighDateTime=0x1d5b697, ftLastWriteTime.dwLowDateTime=0xb3be0770, ftLastWriteTime.dwHighDateTime=0x1d5b697, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="QPlC3MrxDxBoh_nGWn0Q.rtf", cAlternateFileName="QPLC3M~1.RTF")) returned 0x324f58 [0245.417] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8822ce50, ftCreationTime.dwHighDateTime=0x1d5b829, ftLastAccessTime.dwLowDateTime=0xb3be0770, ftLastAccessTime.dwHighDateTime=0x1d5b697, ftLastWriteTime.dwLowDateTime=0xb3be0770, ftLastWriteTime.dwHighDateTime=0x1d5b697, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="QPlC3MrxDxBoh_nGWn0Q.rtf", cAlternateFileName="QPLC3M~1.RTF")) returned 0 [0245.417] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0245.417] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QPlC3MrxDxBoh_nGWn0Q.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qplc3mrxdxboh_ngwn0q.rtf")) returned 1 [0245.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QPlC3MrxDxBoh_nGWn0Q.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qplc3mrxdxboh_ngwn0q.rtf")) returned 0xffffffff [0245.419] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a9ab760, ftCreationTime.dwHighDateTime=0x1d563c1, ftLastAccessTime.dwLowDateTime=0x7fddcbd0, ftLastAccessTime.dwHighDateTime=0x1d542ba, ftLastWriteTime.dwLowDateTime=0x7fddcbd0, ftLastWriteTime.dwHighDateTime=0x1d542ba, nFileSizeHigh=0x0, nFileSizeLow=0x13b6e, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="QSj0.docx", cAlternateFileName="QSJ0~1.DOC")) returned 1 [0245.420] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.420] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.420] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.420] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29704, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.420] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.420] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29704) returned 0x10ab [0245.420] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QSj0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qsj0.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.420] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\51536A30.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\51536a30.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0245.421] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b6e [0245.422] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0245.422] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0245.495] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13b6e, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x13b6e, lpOverlapped=0x0) returned 1 [0245.498] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x13b70, lpOverlapped=0x0) returned 1 [0245.500] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.523] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.534] CloseHandle (hObject=0xf8) returned 1 [0245.534] CloseHandle (hObject=0xf0) returned 1 [0245.534] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QSj0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qsj0.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\51536A30.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\51536a30.docx")) returned 0 [0245.535] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\51536A30.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\51536a30.docx")) returned 0x20 [0245.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QSj0.docx", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a9ab760, ftCreationTime.dwHighDateTime=0x1d563c1, ftLastAccessTime.dwLowDateTime=0x7fddcbd0, ftLastAccessTime.dwHighDateTime=0x1d542ba, ftLastWriteTime.dwLowDateTime=0x7fddcbd0, ftLastWriteTime.dwHighDateTime=0x1d542ba, nFileSizeHigh=0x0, nFileSizeLow=0x13b6e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QSj0.docx", cAlternateFileName="QSJ0~1.DOC")) returned 0x324f58 [0245.535] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a9ab760, ftCreationTime.dwHighDateTime=0x1d563c1, ftLastAccessTime.dwLowDateTime=0x7fddcbd0, ftLastAccessTime.dwHighDateTime=0x1d542ba, ftLastWriteTime.dwLowDateTime=0x7fddcbd0, ftLastWriteTime.dwHighDateTime=0x1d542ba, nFileSizeHigh=0x0, nFileSizeLow=0x13b6e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="QSj0.docx", cAlternateFileName="QSJ0~1.DOC")) returned 0 [0245.535] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0245.535] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QSj0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qsj0.docx")) returned 1 [0245.537] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QSj0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qsj0.docx")) returned 0xffffffff [0245.537] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0fcc6a0, ftCreationTime.dwHighDateTime=0x1d5bac6, ftLastAccessTime.dwLowDateTime=0x15289800, ftLastAccessTime.dwHighDateTime=0x1d57236, ftLastWriteTime.dwLowDateTime=0x15289800, ftLastWriteTime.dwHighDateTime=0x1d57236, nFileSizeHigh=0x0, nFileSizeLow=0x6aaa, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="R2UvMVl1DFxVWCVOUXjE.pptx", cAlternateFileName="R2UVMV~1.PPT")) returned 1 [0245.538] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.538] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.538] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.538] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29a2c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.538] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.539] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29a2c) returned 0x10ab [0245.539] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7031ef20, ftCreationTime.dwHighDateTime=0x1d560b7, ftLastAccessTime.dwLowDateTime=0x2801bc90, ftLastAccessTime.dwHighDateTime=0x1d54653, ftLastWriteTime.dwLowDateTime=0x2801bc90, ftLastWriteTime.dwHighDateTime=0x1d54653, nFileSizeHigh=0x0, nFileSizeLow=0x320c, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="sAaiffj.docx", cAlternateFileName="SAAIFF~1.DOC")) returned 1 [0245.539] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.539] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.539] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.539] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ac8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.539] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.539] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ac8) returned 0x10ab [0245.539] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sAaiffj.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\saaiffj.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0245.539] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7341616966666A.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7341616966666a.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.542] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x320c [0245.542] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0245.542] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0245.652] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x320c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x320c, lpOverlapped=0x0) returned 1 [0245.653] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x3210, lpOverlapped=0x0) returned 1 [0245.654] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.688] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.699] CloseHandle (hObject=0xf0) returned 1 [0245.699] CloseHandle (hObject=0xf8) returned 1 [0245.700] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sAaiffj.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\saaiffj.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7341616966666A.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7341616966666a.docx")) returned 0 [0245.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7341616966666A.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7341616966666a.docx")) returned 0x20 [0245.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sAaiffj.docx", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7031ef20, ftCreationTime.dwHighDateTime=0x1d560b7, ftLastAccessTime.dwLowDateTime=0x2801bc90, ftLastAccessTime.dwHighDateTime=0x1d54653, ftLastWriteTime.dwLowDateTime=0x2801bc90, ftLastWriteTime.dwHighDateTime=0x1d54653, nFileSizeHigh=0x0, nFileSizeLow=0x320c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sAaiffj.docx", cAlternateFileName="SAAIFF~1.DOC")) returned 0x324f58 [0245.701] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7031ef20, ftCreationTime.dwHighDateTime=0x1d560b7, ftLastAccessTime.dwLowDateTime=0x2801bc90, ftLastAccessTime.dwHighDateTime=0x1d54653, ftLastWriteTime.dwLowDateTime=0x2801bc90, ftLastWriteTime.dwHighDateTime=0x1d54653, nFileSizeHigh=0x0, nFileSizeLow=0x320c, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sAaiffj.docx", cAlternateFileName="SAAIFF~1.DOC")) returned 0 [0245.701] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0245.701] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sAaiffj.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\saaiffj.docx")) returned 1 [0245.703] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sAaiffj.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\saaiffj.docx")) returned 0xffffffff [0245.703] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30432fb0, ftCreationTime.dwHighDateTime=0x1d5c551, ftLastAccessTime.dwLowDateTime=0xb31684a0, ftLastAccessTime.dwHighDateTime=0x1d5bd6d, ftLastWriteTime.dwLowDateTime=0xb31684a0, ftLastWriteTime.dwHighDateTime=0x1d5bd6d, nFileSizeHigh=0x0, nFileSizeLow=0xd0bc, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="uaUXHwQq.ods", cAlternateFileName="")) returned 1 [0245.704] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.704] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29cac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.704] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.704] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29cac) returned 0x10ab [0245.704] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe318e550, ftCreationTime.dwHighDateTime=0x1d53c1f, ftLastAccessTime.dwLowDateTime=0xe5b161f0, ftLastAccessTime.dwHighDateTime=0x1d53e79, ftLastWriteTime.dwLowDateTime=0xe5b161f0, ftLastWriteTime.dwHighDateTime=0x1d53e79, nFileSizeHigh=0x0, nFileSizeLow=0x107bc, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="WQS9UWY.pptx", cAlternateFileName="WQS9UW~1.PPT")) returned 1 [0245.705] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.705] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.705] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d40, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.705] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d40) returned 0x10ab [0245.705] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90632810, ftCreationTime.dwHighDateTime=0x1d5c3fc, ftLastAccessTime.dwLowDateTime=0xa2b45130, ftLastAccessTime.dwHighDateTime=0x1d5584d, ftLastWriteTime.dwLowDateTime=0xa2b45130, ftLastWriteTime.dwHighDateTime=0x1d5584d, nFileSizeHigh=0x0, nFileSizeLow=0x1e69, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="x_097aYdjnpcs.docx", cAlternateFileName="X_097A~1.DOC")) returned 1 [0245.705] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.705] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.705] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29dfc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.705] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.705] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29dfc) returned 0x10ab [0245.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x_097aYdjnpcs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x_097aydjnpcs.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\785F3039376159646A6E706373.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\785f3039376159646a6e706373.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0245.707] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e69 [0245.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0245.707] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0245.808] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e69, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1e69, lpOverlapped=0x0) returned 1 [0245.809] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x1e70, lpOverlapped=0x0) returned 1 [0245.810] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.835] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.845] CloseHandle (hObject=0xf8) returned 1 [0245.845] CloseHandle (hObject=0xf0) returned 1 [0245.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x_097aYdjnpcs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x_097aydjnpcs.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\785F3039376159646A6E706373.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\785f3039376159646a6e706373.docx")) returned 0 [0245.847] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\785F3039376159646A6E706373.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\785f3039376159646a6e706373.docx")) returned 0x20 [0245.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x_097aYdjnpcs.docx", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90632810, ftCreationTime.dwHighDateTime=0x1d5c3fc, ftLastAccessTime.dwLowDateTime=0xa2b45130, ftLastAccessTime.dwHighDateTime=0x1d5584d, ftLastWriteTime.dwLowDateTime=0xa2b45130, ftLastWriteTime.dwHighDateTime=0x1d5584d, nFileSizeHigh=0x0, nFileSizeLow=0x1e69, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="x_097aYdjnpcs.docx", cAlternateFileName="X_097A~1.DOC")) returned 0x324f58 [0245.847] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90632810, ftCreationTime.dwHighDateTime=0x1d5c3fc, ftLastAccessTime.dwLowDateTime=0xa2b45130, ftLastAccessTime.dwHighDateTime=0x1d5584d, ftLastWriteTime.dwLowDateTime=0xa2b45130, ftLastWriteTime.dwHighDateTime=0x1d5584d, nFileSizeHigh=0x0, nFileSizeLow=0x1e69, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="x_097aYdjnpcs.docx", cAlternateFileName="X_097A~1.DOC")) returned 0 [0245.847] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0245.847] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x_097aYdjnpcs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x_097aydjnpcs.docx")) returned 1 [0245.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x_097aYdjnpcs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x_097aydjnpcs.docx")) returned 0xffffffff [0245.849] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60617f00, ftCreationTime.dwHighDateTime=0x1d5c577, ftLastAccessTime.dwLowDateTime=0x2930b240, ftLastAccessTime.dwHighDateTime=0x1d5c1bb, ftLastWriteTime.dwLowDateTime=0x2930b240, ftLastWriteTime.dwHighDateTime=0x1d5c1bb, nFileSizeHigh=0x0, nFileSizeLow=0x46ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="y61 MGhTuO.ppt", cAlternateFileName="Y61MGH~1.PPT")) returned 1 [0245.849] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.849] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.849] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.850] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a0e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.850] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.850] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a0e4) returned 0x10ab [0245.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y61 MGhTuO.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y61 mghtuo.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0245.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\793631204D476854754F.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\793631204d476854754f.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.851] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46ac [0245.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0245.851] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0245.926] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x46ac, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x46ac, lpOverlapped=0x0) returned 1 [0245.927] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x46b0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x46b0, lpOverlapped=0x0) returned 1 [0245.944] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.966] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.977] CloseHandle (hObject=0xf0) returned 1 [0245.977] CloseHandle (hObject=0xf8) returned 1 [0245.977] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y61 MGhTuO.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y61 mghtuo.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\793631204D476854754F.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\793631204d476854754f.ppt")) returned 0 [0245.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\793631204D476854754F.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\793631204d476854754f.ppt")) returned 0x20 [0245.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y61 MGhTuO.ppt", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60617f00, ftCreationTime.dwHighDateTime=0x1d5c577, ftLastAccessTime.dwLowDateTime=0x2930b240, ftLastAccessTime.dwHighDateTime=0x1d5c1bb, ftLastWriteTime.dwLowDateTime=0x2930b240, ftLastWriteTime.dwHighDateTime=0x1d5c1bb, nFileSizeHigh=0x0, nFileSizeLow=0x46ac, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="y61 MGhTuO.ppt", cAlternateFileName="Y61MGH~1.PPT")) returned 0x324f58 [0245.979] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60617f00, ftCreationTime.dwHighDateTime=0x1d5c577, ftLastAccessTime.dwLowDateTime=0x2930b240, ftLastAccessTime.dwHighDateTime=0x1d5c1bb, ftLastWriteTime.dwLowDateTime=0x2930b240, ftLastWriteTime.dwHighDateTime=0x1d5c1bb, nFileSizeHigh=0x0, nFileSizeLow=0x46ac, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="y61 MGhTuO.ppt", cAlternateFileName="Y61MGH~1.PPT")) returned 0 [0245.979] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0245.979] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y61 MGhTuO.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y61 mghtuo.ppt")) returned 1 [0245.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y61 MGhTuO.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y61 mghtuo.ppt")) returned 0xffffffff [0245.980] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6141c840, ftCreationTime.dwHighDateTime=0x1d56ba3, ftLastAccessTime.dwLowDateTime=0x72a68800, ftLastAccessTime.dwHighDateTime=0x1d546e1, ftLastWriteTime.dwLowDateTime=0x72a68800, ftLastWriteTime.dwHighDateTime=0x1d546e1, nFileSizeHigh=0x0, nFileSizeLow=0x20db, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_Kx1rzc.pptx", cAlternateFileName="_KX1RZ~1.PPT")) returned 1 [0245.981] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.981] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.981] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.981] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28fc0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.981] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.981] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28fc0) returned 0x10ab [0245.981] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6141c840, ftCreationTime.dwHighDateTime=0x1d56ba3, ftLastAccessTime.dwLowDateTime=0x72a68800, ftLastAccessTime.dwHighDateTime=0x1d546e1, ftLastWriteTime.dwLowDateTime=0x72a68800, ftLastWriteTime.dwHighDateTime=0x1d546e1, nFileSizeHigh=0x0, nFileSizeLow=0x20db, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_Kx1rzc.pptx", cAlternateFileName="_KX1RZ~1.PPT")) returned 0 [0245.982] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0245.982] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64747078, dwReserved1=0x6a78636f, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0245.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0245.982] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="..", cAlternateFileName="")) returned 1 [0245.982] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0245.982] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0245.982] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0245.983] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ca4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0245.983] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0245.983] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ca4) returned 0x10ab [0245.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0245.984] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0245.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0245.984] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0246.057] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x11a, lpOverlapped=0x0) returned 1 [0246.058] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x120, lpOverlapped=0x0) returned 1 [0246.059] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.082] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.092] CloseHandle (hObject=0xf8) returned 1 [0246.093] CloseHandle (hObject=0xf0) returned 1 [0246.093] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\6465736b746f70.ini")) returned 0 [0246.094] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\6465736b746f70.ini")) returned 0x20 [0246.094] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0246.094] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0246.094] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0246.094] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini")) returned 1 [0246.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini")) returned 0xffffffff [0246.095] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0246.095] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0246.095] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64747078, dwReserved1=0x6a78636f, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0246.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0246.095] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="..", cAlternateFileName="")) returned 1 [0246.095] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0246.096] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0246.096] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.096] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0246.096] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0246.096] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.096] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d84) returned 0x10ab [0246.097] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0246.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0246.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0246.098] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192 [0246.098] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0246.098] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0246.188] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x192, lpOverlapped=0x0) returned 1 [0246.189] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x1a0, lpOverlapped=0x0) returned 1 [0246.190] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.212] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.223] CloseHandle (hObject=0xf0) returned 1 [0246.223] CloseHandle (hObject=0xf8) returned 1 [0246.223] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\6465736b746f70.ini")) returned 0 [0246.224] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\6465736b746f70.ini")) returned 0x20 [0246.224] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0246.224] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0246.225] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0246.225] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini")) returned 1 [0246.225] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini")) returned 0xffffffff [0246.225] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Links", cAlternateFileName="")) returned 1 [0246.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680066, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0246.226] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680066, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0246.226] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x680066, dwReserved1=0x31c7b8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0246.227] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0246.227] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.227] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0246.227] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0246.227] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0246.227] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.227] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e10) returned 0x10ab [0246.227] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0246.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0246.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0246.230] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0246.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0246.230] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0246.318] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x50, lpOverlapped=0x0) returned 1 [0246.319] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x60, lpOverlapped=0x0) returned 1 [0246.320] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.342] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.353] CloseHandle (hObject=0xf0) returned 1 [0246.353] CloseHandle (hObject=0xfc) returned 1 [0246.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\6465736b746f70.ini")) returned 0 [0246.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\6465736b746f70.ini")) returned 0x20 [0246.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f98 [0246.354] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0246.354] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0246.354] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini")) returned 1 [0246.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini")) returned 0xffffffff [0246.355] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0246.356] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0246.356] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.356] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0246.356] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0246.357] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27de4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0246.357] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.357] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27de4) returned 0x10ab [0246.357] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0246.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0246.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\537567676573746564205369746573.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\537567676573746564205369746573.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0246.359] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0246.359] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0246.359] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0246.454] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xec, lpOverlapped=0x0) returned 1 [0246.455] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xf0, lpOverlapped=0x0) returned 1 [0246.458] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.481] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.494] CloseHandle (hObject=0xfc) returned 1 [0246.495] CloseHandle (hObject=0xf0) returned 1 [0246.497] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\537567676573746564205369746573.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\537567676573746564205369746573.url")) returned 0 [0246.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\537567676573746564205369746573.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\537567676573746564205369746573.url")) returned 0x20 [0246.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 0x324f98 [0246.499] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 0 [0246.499] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0246.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url")) returned 1 [0246.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url")) returned 0xffffffff [0246.500] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0246.503] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0246.503] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.506] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0246.506] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0246.506] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e70, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0246.506] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.506] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e70) returned 0x10ab [0246.506] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0246.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0246.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\57656220536C6963652047616C6C657279.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\57656220536c6963652047616c6c657279.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0246.508] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0246.508] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0246.508] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0246.600] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0xe2, lpOverlapped=0x0) returned 1 [0246.601] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0xf0, lpOverlapped=0x0) returned 1 [0246.602] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.624] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.635] CloseHandle (hObject=0xf0) returned 1 [0246.635] CloseHandle (hObject=0xfc) returned 1 [0246.635] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\57656220536C6963652047616C6C657279.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\57656220536c6963652047616c6c657279.url")) returned 0 [0246.636] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\57656220536C6963652047616C6C657279.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\57656220536c6963652047616c6c657279.url")) returned 0x20 [0246.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0x324f98 [0246.636] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0246.636] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0246.637] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url")) returned 1 [0246.637] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url")) returned 0xffffffff [0246.637] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0246.637] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0246.637] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x752e7972, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0246.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0246.639] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="..", cAlternateFileName="")) returned 1 [0246.639] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0246.640] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0246.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0246.640] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0246.640] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0246.640] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.640] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f00) returned 0x10ab [0246.640] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0246.641] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0246.641] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4945204164642D6F6E2073697465.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4945204164642d6f6e2073697465.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0246.642] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0246.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0246.642] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0246.727] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0246.728] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0246.729] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.751] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.761] CloseHandle (hObject=0xfc) returned 1 [0246.761] CloseHandle (hObject=0xf0) returned 1 [0246.762] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4945204164642D6F6E2073697465.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4945204164642d6f6e2073697465.url")) returned 0 [0246.762] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4945204164642D6F6E2073697465.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4945204164642d6f6e2073697465.url")) returned 0x20 [0246.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 0x324f98 [0246.763] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 0 [0246.763] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0246.763] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url")) returned 1 [0246.764] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url")) returned 0xffffffff [0246.764] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0246.764] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0246.764] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.764] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0246.764] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0246.765] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0246.765] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.765] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0246.765] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0246.765] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0246.765] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\49452073697465206F6E204D6963726F736F66742E636F6D.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\49452073697465206f6e204d6963726f736f66742e636f6d.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0246.766] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0246.766] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0246.766] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0246.846] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0246.847] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0246.848] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.870] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.881] CloseHandle (hObject=0xf0) returned 1 [0246.881] CloseHandle (hObject=0xfc) returned 1 [0246.881] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\49452073697465206F6E204D6963726F736F66742E636F6D.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\49452073697465206f6e204d6963726f736f66742e636f6d.url")) returned 0 [0246.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\49452073697465206F6E204D6963726F736F66742E636F6D.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\49452073697465206f6e204d6963726f736f66742e636f6d.url")) returned 0x20 [0246.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 0x324f98 [0246.882] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 0 [0246.882] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0246.882] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 1 [0246.883] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 0xffffffff [0246.883] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0246.884] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0246.884] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.884] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0246.884] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0246.884] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0246.884] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0246.884] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fc4) returned 0x10ab [0246.884] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0246.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0246.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F667420417420486F6D65.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f667420417420486f6d65.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0246.886] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0246.886] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0246.886] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0246.979] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0246.980] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0246.981] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.003] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.014] CloseHandle (hObject=0xfc) returned 1 [0247.014] CloseHandle (hObject=0xf0) returned 1 [0247.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F667420417420486F6D65.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f667420417420486f6d65.url")) returned 0 [0247.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F667420417420486F6D65.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f667420417420486f6d65.url")) returned 0x20 [0247.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 0x324f98 [0247.015] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 0 [0247.015] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0247.015] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url")) returned 1 [0247.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url")) returned 0xffffffff [0247.016] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0247.017] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0247.017] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0247.017] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0247.018] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ffc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0247.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ffc) returned 0x10ab [0247.018] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0247.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0247.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F667420417420576F726B.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f667420417420576f726b.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0247.020] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0247.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0247.020] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0247.107] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0247.108] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0247.109] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.131] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.142] CloseHandle (hObject=0xf0) returned 1 [0247.142] CloseHandle (hObject=0xfc) returned 1 [0247.142] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F667420417420576F726B.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f667420417420576f726b.url")) returned 0 [0247.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F667420417420576F726B.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f667420417420576f726b.url")) returned 0x20 [0247.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 0x324f98 [0247.144] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 0 [0247.144] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0247.144] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url")) returned 1 [0247.145] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url")) returned 0xffffffff [0247.145] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0247.146] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0247.146] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.146] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0247.146] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0247.146] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f04, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0247.146] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.146] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f04) returned 0x10ab [0247.146] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0247.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0247.148] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F66742053746F7265.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f66742053746f7265.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0247.152] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86 [0247.152] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0247.152] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0247.240] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x86, lpOverlapped=0x0) returned 1 [0247.240] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0247.241] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.264] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.275] CloseHandle (hObject=0xfc) returned 1 [0247.275] CloseHandle (hObject=0xf0) returned 1 [0247.275] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F66742053746F7265.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f66742053746f7265.url")) returned 0 [0247.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4D6963726F736F66742053746F7265.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\4d6963726f736f66742053746f7265.url")) returned 0x20 [0247.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0x324f98 [0247.277] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0247.277] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0247.277] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url")) returned 1 [0247.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url")) returned 0xffffffff [0247.278] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0247.278] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0247.278] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x6c72752e, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0247.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0247.280] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="..", cAlternateFileName="")) returned 1 [0247.280] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0247.281] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0247.281] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.281] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0247.281] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0247.282] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f70, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0247.282] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.282] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f70) returned 0x10ab [0247.282] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0247.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0247.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E204175746F73.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e204175746f73.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0247.283] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0247.283] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0247.284] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0247.357] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0247.358] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0247.359] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.404] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.415] CloseHandle (hObject=0xf0) returned 1 [0247.415] CloseHandle (hObject=0xfc) returned 1 [0247.415] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E204175746F73.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e204175746f73.url")) returned 0 [0247.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E204175746F73.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e204175746f73.url")) returned 0x20 [0247.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 0x324f98 [0247.416] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 0 [0247.416] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0247.416] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url")) returned 1 [0247.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url")) returned 0xffffffff [0247.417] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0247.418] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0247.418] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.418] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0247.418] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0247.418] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fe8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0247.419] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.419] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fe8) returned 0x10ab [0247.419] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0247.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0247.420] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E20456E7465727461696E6D656E74.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e20456e7465727461696e6d656e74.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0247.421] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0247.421] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0247.421] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0247.492] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0247.493] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0247.494] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.515] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.527] CloseHandle (hObject=0xfc) returned 1 [0247.527] CloseHandle (hObject=0xf0) returned 1 [0247.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E20456E7465727461696E6D656E74.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e20456e7465727461696e6d656e74.url")) returned 0 [0247.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E20456E7465727461696E6D656E74.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e20456e7465727461696e6d656e74.url")) returned 0x20 [0247.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 0x324f98 [0247.528] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 0 [0247.528] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0247.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url")) returned 1 [0247.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url")) returned 0xffffffff [0247.529] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0247.529] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0247.529] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.529] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0247.529] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0247.530] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0247.530] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.530] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0247.530] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0247.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0247.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E204D6F6E6579.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e204d6f6e6579.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0247.532] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0247.532] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0247.532] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0247.630] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0247.631] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0247.632] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.654] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.673] CloseHandle (hObject=0xf0) returned 1 [0247.673] CloseHandle (hObject=0xfc) returned 1 [0247.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E204D6F6E6579.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e204d6f6e6579.url")) returned 0 [0247.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E204D6F6E6579.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e204d6f6e6579.url")) returned 0x20 [0247.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 0x324f98 [0247.675] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 0 [0247.675] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0247.675] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url")) returned 1 [0247.676] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url")) returned 0xffffffff [0247.676] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0247.676] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0247.677] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.677] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0247.677] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0247.677] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0247.677] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.677] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e10) returned 0x10ab [0247.677] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0247.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0247.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E2053706F727473.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e2053706f727473.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0247.679] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0247.679] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0247.679] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0247.766] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0247.767] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0247.768] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.790] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.810] CloseHandle (hObject=0xfc) returned 1 [0247.810] CloseHandle (hObject=0xf0) returned 1 [0247.810] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E2053706F727473.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e2053706f727473.url")) returned 0 [0247.811] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E2053706F727473.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e2053706f727473.url")) returned 0x20 [0247.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 0x324f98 [0247.811] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 0 [0247.811] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0247.811] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url")) returned 1 [0247.812] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url")) returned 0xffffffff [0247.812] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0247.813] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0247.813] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.813] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0247.813] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0247.813] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ea0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0247.813] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.813] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ea0) returned 0x10ab [0247.814] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0247.814] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0247.814] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0247.815] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0247.815] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0247.815] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0247.888] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0247.889] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0247.890] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.912] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.924] CloseHandle (hObject=0xf0) returned 1 [0247.924] CloseHandle (hObject=0xfc) returned 1 [0247.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e.url")) returned 0 [0247.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e.url")) returned 0x20 [0247.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSN.url", cAlternateFileName="")) returned 0x324f98 [0247.925] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSN.url", cAlternateFileName="")) returned 0 [0247.925] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0247.925] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url")) returned 1 [0247.926] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url")) returned 0xffffffff [0247.926] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0247.927] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0247.927] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.927] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0247.927] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0247.927] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dd0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0247.927] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0247.927] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dd0) returned 0x10ab [0247.928] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0247.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0247.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E4243204E657773.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e4243204e657773.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0247.931] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0247.931] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0247.931] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0248.016] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0248.017] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0248.018] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.040] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.050] CloseHandle (hObject=0xfc) returned 1 [0248.051] CloseHandle (hObject=0xf0) returned 1 [0248.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E4243204E657773.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e4243204e657773.url")) returned 0 [0248.051] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4D534E4243204E657773.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\4d534e4243204e657773.url")) returned 0x20 [0248.051] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0x324f98 [0248.052] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0248.052] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0248.052] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url")) returned 1 [0248.053] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url")) returned 0xffffffff [0248.053] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0248.053] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0248.053] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0248.053] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0248.055] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="..", cAlternateFileName="")) returned 1 [0248.055] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0248.056] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0248.056] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.056] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0248.056] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0248.056] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ea8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0248.056] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.056] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ea8) returned 0x10ab [0248.056] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0248.056] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0248.060] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\4765742057696E646F7773204C697665.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\4765742057696e646f7773204c697665.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0248.061] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0248.061] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0248.061] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0248.147] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0248.148] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0248.149] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.171] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.182] CloseHandle (hObject=0xf0) returned 1 [0248.182] CloseHandle (hObject=0xfc) returned 1 [0248.182] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\4765742057696E646F7773204C697665.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\4765742057696e646f7773204c697665.url")) returned 0 [0248.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\4765742057696E646F7773204C697665.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\4765742057696e646f7773204c697665.url")) returned 0x20 [0248.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 0x324f98 [0248.183] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 0 [0248.183] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0248.183] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url")) returned 1 [0248.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url")) returned 0xffffffff [0248.184] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0248.185] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0248.185] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.185] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0248.185] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0248.186] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e5c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0248.186] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.186] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e5c) returned 0x10ab [0248.186] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0248.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0248.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C6976652047616C6C657279.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c6976652047616c6c657279.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0248.191] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0248.191] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0248.191] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0248.280] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0248.281] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0248.282] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.304] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.315] CloseHandle (hObject=0xfc) returned 1 [0248.315] CloseHandle (hObject=0xf0) returned 1 [0248.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C6976652047616C6C657279.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c6976652047616c6c657279.url")) returned 0 [0248.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C6976652047616C6C657279.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c6976652047616c6c657279.url")) returned 0x20 [0248.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 0x324f98 [0248.316] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 0 [0248.316] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0248.316] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url")) returned 1 [0248.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url")) returned 0xffffffff [0248.317] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0248.318] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0248.320] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.320] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0248.320] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0248.320] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ecc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0248.320] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.320] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ecc) returned 0x10ab [0248.320] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0248.320] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0248.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C697665204D61696C.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c697665204d61696c.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0248.321] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0248.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0248.322] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0248.427] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0248.428] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0248.428] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.450] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.461] CloseHandle (hObject=0xf0) returned 1 [0248.461] CloseHandle (hObject=0xfc) returned 1 [0248.461] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C697665204D61696C.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c697665204d61696c.url")) returned 0 [0248.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C697665204D61696C.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c697665204d61696c.url")) returned 0x20 [0248.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 0x324f98 [0248.462] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 0 [0248.462] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0248.462] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url")) returned 1 [0248.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url")) returned 0xffffffff [0248.463] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0248.464] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0248.464] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.464] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0248.464] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0248.465] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ea8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0248.465] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.465] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ea8) returned 0x10ab [0248.465] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0248.465] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0248.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C69766520537061636573.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c69766520537061636573.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0248.467] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0248.467] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0248.467] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0248.554] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0248.555] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0248.556] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.578] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.592] CloseHandle (hObject=0xfc) returned 1 [0248.592] CloseHandle (hObject=0xf0) returned 1 [0248.592] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C69766520537061636573.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c69766520537061636573.url")) returned 0 [0248.593] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57696E646F7773204C69766520537061636573.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\57696e646f7773204c69766520537061636573.url")) returned 0x20 [0248.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0x324f98 [0248.593] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0248.593] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0248.593] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url")) returned 1 [0248.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url")) returned 0xffffffff [0248.595] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0248.595] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0248.595] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0248.595] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0248.595] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69736265, dwReserved1=0x6a736574, cFileName="Links", cAlternateFileName="")) returned 1 [0248.595] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0248.595] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="..", cAlternateFileName="")) returned 1 [0248.595] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0248.596] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0248.596] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.596] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0248.596] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0248.596] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0248.596] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.597] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f4c) returned 0x10ab [0248.597] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0248.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0248.598] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0248.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0248.598] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0248.669] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x244, lpOverlapped=0x0) returned 1 [0248.670] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x250, lpOverlapped=0x0) returned 1 [0248.671] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.693] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.704] CloseHandle (hObject=0xf8) returned 1 [0248.704] CloseHandle (hObject=0xf0) returned 1 [0248.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\6465736b746f70.ini")) returned 0 [0248.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\6465736b746f70.ini")) returned 0x20 [0248.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0248.706] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0248.706] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0248.706] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini")) returned 1 [0248.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini")) returned 0xffffffff [0248.707] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0248.707] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0248.707] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.708] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0248.708] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0248.708] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27fb4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0248.708] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.708] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27fb4) returned 0x10ab [0248.708] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0248.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0248.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\4465736B746F70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\4465736b746f70.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.712] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e6 [0248.713] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0248.713] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0248.797] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1e6, lpOverlapped=0x0) returned 1 [0248.798] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x1f0, lpOverlapped=0x0) returned 1 [0248.799] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.830] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.841] CloseHandle (hObject=0xf0) returned 1 [0248.841] CloseHandle (hObject=0xf8) returned 1 [0248.841] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\4465736B746F70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\4465736b746f70.lnk")) returned 0 [0248.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\4465736B746F70.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\4465736b746f70.lnk")) returned 0x20 [0248.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0x324f58 [0248.842] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0 [0248.842] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0248.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk")) returned 1 [0248.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk")) returned 0xffffffff [0248.843] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0248.844] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0248.844] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.844] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0248.844] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0248.844] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ffc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0248.844] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.844] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ffc) returned 0x10ab [0248.844] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0248.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\446F776E6C6F616473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\446f776e6c6f616473.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0248.846] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a1 [0248.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0248.846] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0248.933] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3a1, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x3a1, lpOverlapped=0x0) returned 1 [0248.936] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x3b0, lpOverlapped=0x0) returned 1 [0248.937] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.959] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.970] CloseHandle (hObject=0xf8) returned 1 [0248.970] CloseHandle (hObject=0xf0) returned 1 [0248.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\446F776E6C6F616473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\446f776e6c6f616473.lnk")) returned 0 [0248.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\446F776E6C6F616473.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\446f776e6c6f616473.lnk")) returned 0x20 [0248.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0x324f58 [0248.972] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0 [0248.972] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0248.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk")) returned 1 [0248.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk")) returned 0xffffffff [0248.973] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0248.974] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0248.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0248.974] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0248.974] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ef0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0248.974] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0248.974] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ef0) returned 0x10ab [0248.974] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0248.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0248.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\526563656E74506C61636573.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\526563656e74506c61636573.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.976] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b [0248.976] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0248.977] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0249.063] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x16b, lpOverlapped=0x0) returned 1 [0249.064] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x170, lpOverlapped=0x0) returned 1 [0249.065] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.087] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.098] CloseHandle (hObject=0xf0) returned 1 [0249.098] CloseHandle (hObject=0xf8) returned 1 [0249.098] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\526563656E74506C61636573.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\526563656e74506c61636573.lnk")) returned 0 [0249.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\526563656E74506C61636573.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\526563656e74506c61636573.lnk")) returned 0x20 [0249.099] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0x324f58 [0249.099] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0249.099] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0249.100] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk")) returned 1 [0249.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk")) returned 0xffffffff [0249.100] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0249.100] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0249.101] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6a73656b, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0249.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="RecentPlaces.lnk", cAlternateFileName="°³1")) returned 0xffffffff [0249.101] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f17e6b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f17e6b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6a73656b, cFileName="Music", cAlternateFileName="")) returned 1 [0249.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f17e6b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f17e6b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0249.101] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f17e6b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f17e6b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="..", cAlternateFileName="")) returned 1 [0249.101] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a1f850, ftCreationTime.dwHighDateTime=0x1d5c510, ftLastAccessTime.dwLowDateTime=0xfd5a3da0, ftLastAccessTime.dwHighDateTime=0x1d5bce5, ftLastWriteTime.dwLowDateTime=0xfd5a3da0, ftLastWriteTime.dwHighDateTime=0x1d5bce5, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="-baCM.mp3", cAlternateFileName="")) returned 1 [0249.102] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0249.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0249.102] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0249.102] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ea0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0249.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ea0) returned 0x10ab [0249.103] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0249.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-baCM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-bacm.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2D6261434D.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2d6261434d.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0249.104] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9fe [0249.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0249.104] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0249.176] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x9fe, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x9fe, lpOverlapped=0x0) returned 1 [0249.177] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xa00, lpOverlapped=0x0) returned 1 [0249.178] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.200] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.211] CloseHandle (hObject=0xf8) returned 1 [0249.211] CloseHandle (hObject=0xf0) returned 1 [0249.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-baCM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-bacm.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2D6261434D.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2d6261434d.mp3")) returned 0 [0249.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2D6261434D.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2d6261434d.mp3")) returned 0x20 [0249.212] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-baCM.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a1f850, ftCreationTime.dwHighDateTime=0x1d5c510, ftLastAccessTime.dwLowDateTime=0xfd5a3da0, ftLastAccessTime.dwHighDateTime=0x1d5bce5, ftLastWriteTime.dwLowDateTime=0xfd5a3da0, ftLastWriteTime.dwHighDateTime=0x1d5bce5, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="-baCM.mp3", cAlternateFileName="")) returned 0x324f58 [0249.212] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a1f850, ftCreationTime.dwHighDateTime=0x1d5c510, ftLastAccessTime.dwLowDateTime=0xfd5a3da0, ftLastAccessTime.dwHighDateTime=0x1d5bce5, ftLastWriteTime.dwLowDateTime=0xfd5a3da0, ftLastWriteTime.dwHighDateTime=0x1d5bce5, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="-baCM.mp3", cAlternateFileName="")) returned 0 [0249.212] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0249.212] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-baCM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-bacm.mp3")) returned 1 [0249.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-baCM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-bacm.mp3")) returned 0xffffffff [0249.213] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e76830, ftCreationTime.dwHighDateTime=0x1d5c39c, ftLastAccessTime.dwLowDateTime=0x4b5a1070, ftLastAccessTime.dwHighDateTime=0x1d5ba3e, ftLastWriteTime.dwLowDateTime=0x4b5a1070, ftLastWriteTime.dwHighDateTime=0x1d5ba3e, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="6sQd-fC1_aL7.wav", cAlternateFileName="6SQD-F~1.WAV")) returned 1 [0249.214] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0249.214] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.214] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0249.214] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0249.214] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0249.214] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.214] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f44) returned 0x10ab [0249.214] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0249.215] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0249.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6sQd-fC1_aL7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6sqd-fc1_al7.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0249.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\367351642D6643315F614C37.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\367351642d6643315f614c37.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.216] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b0d [0249.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0249.216] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0249.308] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4b0d, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x4b0d, lpOverlapped=0x0) returned 1 [0249.309] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x4b10, lpOverlapped=0x0) returned 1 [0249.310] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.332] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.342] CloseHandle (hObject=0xf0) returned 1 [0249.342] CloseHandle (hObject=0xf8) returned 1 [0249.343] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6sQd-fC1_aL7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6sqd-fc1_al7.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\367351642D6643315F614C37.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\367351642d6643315f614c37.wav")) returned 0 [0249.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\367351642D6643315F614C37.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\367351642d6643315f614c37.wav")) returned 0x20 [0249.344] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6sQd-fC1_aL7.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e76830, ftCreationTime.dwHighDateTime=0x1d5c39c, ftLastAccessTime.dwLowDateTime=0x4b5a1070, ftLastAccessTime.dwHighDateTime=0x1d5ba3e, ftLastWriteTime.dwLowDateTime=0x4b5a1070, ftLastWriteTime.dwHighDateTime=0x1d5ba3e, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="6sQd-fC1_aL7.wav", cAlternateFileName="6SQD-F~1.WAV")) returned 0x324f58 [0249.344] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e76830, ftCreationTime.dwHighDateTime=0x1d5c39c, ftLastAccessTime.dwLowDateTime=0x4b5a1070, ftLastAccessTime.dwHighDateTime=0x1d5ba3e, ftLastWriteTime.dwLowDateTime=0x4b5a1070, ftLastWriteTime.dwHighDateTime=0x1d5ba3e, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="6sQd-fC1_aL7.wav", cAlternateFileName="6SQD-F~1.WAV")) returned 0 [0249.344] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0249.344] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6sQd-fC1_aL7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6sqd-fc1_al7.wav")) returned 1 [0249.345] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6sQd-fC1_aL7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6sqd-fc1_al7.wav")) returned 0xffffffff [0249.345] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb66b270, ftCreationTime.dwHighDateTime=0x1d5b95f, ftLastAccessTime.dwLowDateTime=0x49c886c0, ftLastAccessTime.dwHighDateTime=0x1d5c57d, ftLastWriteTime.dwLowDateTime=0x49c886c0, ftLastWriteTime.dwHighDateTime=0x1d5c57d, nFileSizeHigh=0x0, nFileSizeLow=0xc54b, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="akam2LRB4qfY.m4a", cAlternateFileName="AKAM2L~1.M4A")) returned 1 [0249.345] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0249.346] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.346] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0249.346] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28104, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0249.346] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.346] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28104) returned 0x10ab [0249.346] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0249.346] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0249.346] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.346] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0249.346] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c281a0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0249.346] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.346] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c281a0) returned 0x10ab [0249.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0249.348] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0249.348] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0249.348] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0249.447] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1f8, lpOverlapped=0x0) returned 1 [0249.448] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x200, lpOverlapped=0x0) returned 1 [0249.449] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.471] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.481] CloseHandle (hObject=0xf8) returned 1 [0249.481] CloseHandle (hObject=0xf0) returned 1 [0249.481] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6465736b746f70.ini")) returned 0 [0249.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6465736b746f70.ini")) returned 0x20 [0249.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0249.483] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0249.483] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0249.483] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini")) returned 1 [0249.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini")) returned 0xffffffff [0249.484] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9584c0, ftCreationTime.dwHighDateTime=0x1d5bba6, ftLastAccessTime.dwLowDateTime=0x707ae5d0, ftLastAccessTime.dwHighDateTime=0x1d5b829, ftLastWriteTime.dwLowDateTime=0x707ae5d0, ftLastWriteTime.dwHighDateTime=0x1d5b829, nFileSizeHigh=0x0, nFileSizeLow=0xb456, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="GjQSScok1tp_.mp3", cAlternateFileName="GJQSSC~1.MP3")) returned 1 [0249.485] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0249.485] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0249.485] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c283b8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0249.485] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c283b8) returned 0x10ab [0249.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GjQSScok1tp_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gjqsscok1tp_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0249.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\476A515353636F6B3174705F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\476a515353636f6b3174705f.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.486] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb456 [0249.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0249.487] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0249.573] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb456, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xb456, lpOverlapped=0x0) returned 1 [0249.575] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb460, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xb460, lpOverlapped=0x0) returned 1 [0249.587] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.609] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.620] CloseHandle (hObject=0xf0) returned 1 [0249.620] CloseHandle (hObject=0xf8) returned 1 [0249.620] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GjQSScok1tp_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gjqsscok1tp_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\476A515353636F6B3174705F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\476a515353636f6b3174705f.mp3")) returned 0 [0249.621] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\476A515353636F6B3174705F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\476a515353636f6b3174705f.mp3")) returned 0x20 [0249.621] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GjQSScok1tp_.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9584c0, ftCreationTime.dwHighDateTime=0x1d5bba6, ftLastAccessTime.dwLowDateTime=0x707ae5d0, ftLastAccessTime.dwHighDateTime=0x1d5b829, ftLastWriteTime.dwLowDateTime=0x707ae5d0, ftLastWriteTime.dwHighDateTime=0x1d5b829, nFileSizeHigh=0x0, nFileSizeLow=0xb456, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="GjQSScok1tp_.mp3", cAlternateFileName="GJQSSC~1.MP3")) returned 0x324f58 [0249.621] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9584c0, ftCreationTime.dwHighDateTime=0x1d5bba6, ftLastAccessTime.dwLowDateTime=0x707ae5d0, ftLastAccessTime.dwHighDateTime=0x1d5b829, ftLastWriteTime.dwLowDateTime=0x707ae5d0, ftLastWriteTime.dwHighDateTime=0x1d5b829, nFileSizeHigh=0x0, nFileSizeLow=0xb456, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="GjQSScok1tp_.mp3", cAlternateFileName="GJQSSC~1.MP3")) returned 0 [0249.621] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0249.621] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GjQSScok1tp_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gjqsscok1tp_.mp3")) returned 1 [0249.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GjQSScok1tp_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gjqsscok1tp_.mp3")) returned 0xffffffff [0249.622] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc0a170, ftCreationTime.dwHighDateTime=0x1d5b7d3, ftLastAccessTime.dwLowDateTime=0x43c75800, ftLastAccessTime.dwHighDateTime=0x1d5b60f, ftLastWriteTime.dwLowDateTime=0x43c75800, ftLastWriteTime.dwHighDateTime=0x1d5b60f, nFileSizeHigh=0x0, nFileSizeLow=0x15602, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="KF7-WOC087YnvtWs48wt.mp3", cAlternateFileName="KF7-WO~1.MP3")) returned 1 [0249.623] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0249.624] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.624] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0249.624] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2869c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0249.624] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.624] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2869c) returned 0x10ab [0249.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KF7-WOC087YnvtWs48wt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kf7-woc087ynvtws48wt.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4B46372D574F43303837596E7674577334387774.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4b46372d574f43303837596e7674577334387774.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0249.625] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15602 [0249.625] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0249.625] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0249.696] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x15602, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x15602, lpOverlapped=0x0) returned 1 [0249.698] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x15610, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x15610, lpOverlapped=0x0) returned 1 [0249.700] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.722] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.734] CloseHandle (hObject=0xf8) returned 1 [0249.734] CloseHandle (hObject=0xf0) returned 1 [0249.734] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KF7-WOC087YnvtWs48wt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kf7-woc087ynvtws48wt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4B46372D574F43303837596E7674577334387774.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4b46372d574f43303837596e7674577334387774.mp3")) returned 0 [0249.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4B46372D574F43303837596E7674577334387774.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4b46372d574f43303837596e7674577334387774.mp3")) returned 0x20 [0249.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KF7-WOC087YnvtWs48wt.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc0a170, ftCreationTime.dwHighDateTime=0x1d5b7d3, ftLastAccessTime.dwLowDateTime=0x43c75800, ftLastAccessTime.dwHighDateTime=0x1d5b60f, ftLastWriteTime.dwLowDateTime=0x43c75800, ftLastWriteTime.dwHighDateTime=0x1d5b60f, nFileSizeHigh=0x0, nFileSizeLow=0x15602, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="KF7-WOC087YnvtWs48wt.mp3", cAlternateFileName="KF7-WO~1.MP3")) returned 0x324f58 [0249.735] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc0a170, ftCreationTime.dwHighDateTime=0x1d5b7d3, ftLastAccessTime.dwLowDateTime=0x43c75800, ftLastAccessTime.dwHighDateTime=0x1d5b60f, ftLastWriteTime.dwLowDateTime=0x43c75800, ftLastWriteTime.dwHighDateTime=0x1d5b60f, nFileSizeHigh=0x0, nFileSizeLow=0x15602, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="KF7-WOC087YnvtWs48wt.mp3", cAlternateFileName="KF7-WO~1.MP3")) returned 0 [0249.735] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0249.735] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KF7-WOC087YnvtWs48wt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kf7-woc087ynvtws48wt.mp3")) returned 1 [0249.736] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KF7-WOC087YnvtWs48wt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kf7-woc087ynvtws48wt.mp3")) returned 0xffffffff [0249.737] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85563530, ftCreationTime.dwHighDateTime=0x1d5c2bb, ftLastAccessTime.dwLowDateTime=0xc7d83380, ftLastAccessTime.dwHighDateTime=0x1d5b6d2, ftLastWriteTime.dwLowDateTime=0xc7d83380, ftLastWriteTime.dwHighDateTime=0x1d5b6d2, nFileSizeHigh=0x0, nFileSizeLow=0xae51, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="knP1.wav", cAlternateFileName="")) returned 1 [0249.737] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0249.737] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.738] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0249.738] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2892c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0249.738] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.738] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2892c) returned 0x10ab [0249.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\knP1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\knp1.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0249.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6B6E5031.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6b6e5031.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.739] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae51 [0249.739] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0249.739] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0249.844] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xae51, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xae51, lpOverlapped=0x0) returned 1 [0249.846] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xae60, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xae60, lpOverlapped=0x0) returned 1 [0249.847] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.870] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.881] CloseHandle (hObject=0xf0) returned 1 [0249.881] CloseHandle (hObject=0xf8) returned 1 [0249.881] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\knP1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\knp1.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6B6E5031.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6b6e5031.wav")) returned 0 [0249.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6B6E5031.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6b6e5031.wav")) returned 0x20 [0249.883] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\knP1.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85563530, ftCreationTime.dwHighDateTime=0x1d5c2bb, ftLastAccessTime.dwLowDateTime=0xc7d83380, ftLastAccessTime.dwHighDateTime=0x1d5b6d2, ftLastWriteTime.dwLowDateTime=0xc7d83380, ftLastWriteTime.dwHighDateTime=0x1d5b6d2, nFileSizeHigh=0x0, nFileSizeLow=0xae51, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="knP1.wav", cAlternateFileName="")) returned 0x324f58 [0249.883] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85563530, ftCreationTime.dwHighDateTime=0x1d5c2bb, ftLastAccessTime.dwLowDateTime=0xc7d83380, ftLastAccessTime.dwHighDateTime=0x1d5b6d2, ftLastWriteTime.dwLowDateTime=0xc7d83380, ftLastWriteTime.dwHighDateTime=0x1d5b6d2, nFileSizeHigh=0x0, nFileSizeLow=0xae51, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="knP1.wav", cAlternateFileName="")) returned 0 [0249.883] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0249.883] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\knP1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\knp1.wav")) returned 1 [0249.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\knP1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\knp1.wav")) returned 0xffffffff [0249.884] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2562e5c0, ftCreationTime.dwHighDateTime=0x1d5c1d9, ftLastAccessTime.dwLowDateTime=0xb6e02c90, ftLastAccessTime.dwHighDateTime=0x1d5bc09, ftLastWriteTime.dwLowDateTime=0xb6e02c90, ftLastWriteTime.dwHighDateTime=0x1d5bc09, nFileSizeHigh=0x0, nFileSizeLow=0xacc7, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="LpMqI3AtK2VRl-mVDeS9.wav", cAlternateFileName="LPMQI3~1.WAV")) returned 1 [0249.886] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0249.886] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.886] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0249.886] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28bc0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0249.886] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0249.886] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28bc0) returned 0x10ab [0249.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LpMqI3AtK2VRl-mVDeS9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lpmqi3atk2vrl-mvdes9.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4C704D71493341744B3256526C2D6D5644655339.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4c704d71493341744b3256526c2d6d5644655339.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0249.887] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xacc7 [0249.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0249.888] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0249.976] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xacc7, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xacc7, lpOverlapped=0x0) returned 1 [0249.978] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xacd0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xacd0, lpOverlapped=0x0) returned 1 [0249.979] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.002] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.012] CloseHandle (hObject=0xf8) returned 1 [0250.012] CloseHandle (hObject=0xf0) returned 1 [0250.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LpMqI3AtK2VRl-mVDeS9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lpmqi3atk2vrl-mvdes9.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4C704D71493341744B3256526C2D6D5644655339.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4c704d71493341744b3256526c2d6d5644655339.wav")) returned 0 [0250.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4C704D71493341744B3256526C2D6D5644655339.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4c704d71493341744b3256526c2d6d5644655339.wav")) returned 0x20 [0250.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LpMqI3AtK2VRl-mVDeS9.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2562e5c0, ftCreationTime.dwHighDateTime=0x1d5c1d9, ftLastAccessTime.dwLowDateTime=0xb6e02c90, ftLastAccessTime.dwHighDateTime=0x1d5bc09, ftLastWriteTime.dwLowDateTime=0xb6e02c90, ftLastWriteTime.dwHighDateTime=0x1d5bc09, nFileSizeHigh=0x0, nFileSizeLow=0xacc7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="LpMqI3AtK2VRl-mVDeS9.wav", cAlternateFileName="LPMQI3~1.WAV")) returned 0x324f58 [0250.014] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2562e5c0, ftCreationTime.dwHighDateTime=0x1d5c1d9, ftLastAccessTime.dwLowDateTime=0xb6e02c90, ftLastAccessTime.dwHighDateTime=0x1d5bc09, ftLastWriteTime.dwLowDateTime=0xb6e02c90, ftLastWriteTime.dwHighDateTime=0x1d5bc09, nFileSizeHigh=0x0, nFileSizeLow=0xacc7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="LpMqI3AtK2VRl-mVDeS9.wav", cAlternateFileName="LPMQI3~1.WAV")) returned 0 [0250.014] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0250.014] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LpMqI3AtK2VRl-mVDeS9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lpmqi3atk2vrl-mvdes9.wav")) returned 1 [0250.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LpMqI3AtK2VRl-mVDeS9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lpmqi3atk2vrl-mvdes9.wav")) returned 0xffffffff [0250.015] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8670400, ftCreationTime.dwHighDateTime=0x1d5b9f6, ftLastAccessTime.dwLowDateTime=0xa0869a20, ftLastAccessTime.dwHighDateTime=0x1d5c419, ftLastWriteTime.dwLowDateTime=0xa0869a20, ftLastWriteTime.dwHighDateTime=0x1d5c419, nFileSizeHigh=0x0, nFileSizeLow=0x15157, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="lVbL-rcdl9zewT.wav", cAlternateFileName="LVBL-R~1.WAV")) returned 1 [0250.016] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.016] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.016] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28e68, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.016] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.017] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28e68) returned 0x10ab [0250.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lVbL-rcdl9zewT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lvbl-rcdl9zewt.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0250.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6C56624C2D7263646C397A657754.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6c56624c2d7263646c397a657754.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.018] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15157 [0250.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0250.018] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0250.106] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x15157, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x15157, lpOverlapped=0x0) returned 1 [0250.109] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x15160, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x15160, lpOverlapped=0x0) returned 1 [0250.111] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.133] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.144] CloseHandle (hObject=0xf0) returned 1 [0250.144] CloseHandle (hObject=0xf8) returned 1 [0250.145] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lVbL-rcdl9zewT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lvbl-rcdl9zewt.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6C56624C2D7263646C397A657754.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6c56624c2d7263646c397a657754.wav")) returned 0 [0250.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6C56624C2D7263646C397A657754.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6c56624c2d7263646c397a657754.wav")) returned 0x20 [0250.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lVbL-rcdl9zewT.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8670400, ftCreationTime.dwHighDateTime=0x1d5b9f6, ftLastAccessTime.dwLowDateTime=0xa0869a20, ftLastAccessTime.dwHighDateTime=0x1d5c419, ftLastWriteTime.dwLowDateTime=0xa0869a20, ftLastWriteTime.dwHighDateTime=0x1d5c419, nFileSizeHigh=0x0, nFileSizeLow=0x15157, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="lVbL-rcdl9zewT.wav", cAlternateFileName="LVBL-R~1.WAV")) returned 0x324f58 [0250.146] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8670400, ftCreationTime.dwHighDateTime=0x1d5b9f6, ftLastAccessTime.dwLowDateTime=0xa0869a20, ftLastAccessTime.dwHighDateTime=0x1d5c419, ftLastWriteTime.dwLowDateTime=0xa0869a20, ftLastWriteTime.dwHighDateTime=0x1d5c419, nFileSizeHigh=0x0, nFileSizeLow=0x15157, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="lVbL-rcdl9zewT.wav", cAlternateFileName="LVBL-R~1.WAV")) returned 0 [0250.146] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0250.146] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lVbL-rcdl9zewT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lvbl-rcdl9zewt.wav")) returned 1 [0250.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lVbL-rcdl9zewT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lvbl-rcdl9zewt.wav")) returned 0xffffffff [0250.147] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140a7630, ftCreationTime.dwHighDateTime=0x1d5c369, ftLastAccessTime.dwLowDateTime=0x46aaa4f0, ftLastAccessTime.dwHighDateTime=0x1d5bbb9, ftLastWriteTime.dwLowDateTime=0x46aaa4f0, ftLastWriteTime.dwHighDateTime=0x1d5bbb9, nFileSizeHigh=0x0, nFileSizeLow=0xecd7, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="m6ZR2.m4a", cAlternateFileName="")) returned 1 [0250.148] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.148] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.148] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.148] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27c08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.148] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.148] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27c08) returned 0x10ab [0250.149] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dfc5df0, ftCreationTime.dwHighDateTime=0x1d5b8af, ftLastAccessTime.dwLowDateTime=0x22d76ce0, ftLastAccessTime.dwHighDateTime=0x1d5bc1b, ftLastWriteTime.dwLowDateTime=0x22d76ce0, ftLastWriteTime.dwHighDateTime=0x1d5bc1b, nFileSizeHigh=0x0, nFileSizeLow=0xee77, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="ozT1F2sKd.m4a", cAlternateFileName="OZT1F2~1.M4A")) returned 1 [0250.149] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.149] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29078, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29078) returned 0x10ab [0250.149] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40f9a50, ftCreationTime.dwHighDateTime=0x1d5bbd6, ftLastAccessTime.dwLowDateTime=0xb2893c50, ftLastAccessTime.dwHighDateTime=0x1d5c50e, ftLastWriteTime.dwLowDateTime=0xb2893c50, ftLastWriteTime.dwHighDateTime=0x1d5c50e, nFileSizeHigh=0x0, nFileSizeLow=0x36d5, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="PBfkBy u8Gk_fs81DP.m4a", cAlternateFileName="PBFKBY~1.M4A")) returned 1 [0250.150] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.150] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.150] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.150] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27c08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.150] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.150] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27c08) returned 0x10ab [0250.150] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e2be00, ftCreationTime.dwHighDateTime=0x1d5b9d2, ftLastAccessTime.dwLowDateTime=0xf82f5900, ftLastAccessTime.dwHighDateTime=0x1d5b6eb, ftLastWriteTime.dwLowDateTime=0xf82f5900, ftLastWriteTime.dwHighDateTime=0x1d5b6eb, nFileSizeHigh=0x0, nFileSizeLow=0x12bf6, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="PZIAoec.wav", cAlternateFileName="")) returned 1 [0250.150] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.150] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.150] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.150] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27c08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.150] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.150] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27c08) returned 0x10ab [0250.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PZIAoec.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pziaoec.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\505A49416F6563.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\505a49416f6563.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0250.152] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12bf6 [0250.152] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0250.152] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0250.223] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12bf6, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x12bf6, lpOverlapped=0x0) returned 1 [0250.225] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12c00, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x12c00, lpOverlapped=0x0) returned 1 [0250.227] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.249] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.260] CloseHandle (hObject=0xf8) returned 1 [0250.260] CloseHandle (hObject=0xf0) returned 1 [0250.260] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PZIAoec.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pziaoec.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\505A49416F6563.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\505a49416f6563.wav")) returned 0 [0250.261] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\505A49416F6563.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\505a49416f6563.wav")) returned 0x20 [0250.261] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PZIAoec.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e2be00, ftCreationTime.dwHighDateTime=0x1d5b9d2, ftLastAccessTime.dwLowDateTime=0xf82f5900, ftLastAccessTime.dwHighDateTime=0x1d5b6eb, ftLastWriteTime.dwLowDateTime=0xf82f5900, ftLastWriteTime.dwHighDateTime=0x1d5b6eb, nFileSizeHigh=0x0, nFileSizeLow=0x12bf6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="PZIAoec.wav", cAlternateFileName="")) returned 0x324f58 [0250.261] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e2be00, ftCreationTime.dwHighDateTime=0x1d5b9d2, ftLastAccessTime.dwLowDateTime=0xf82f5900, ftLastAccessTime.dwHighDateTime=0x1d5b6eb, ftLastWriteTime.dwLowDateTime=0xf82f5900, ftLastWriteTime.dwHighDateTime=0x1d5b6eb, nFileSizeHigh=0x0, nFileSizeLow=0x12bf6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="PZIAoec.wav", cAlternateFileName="")) returned 0 [0250.261] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0250.261] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PZIAoec.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pziaoec.wav")) returned 1 [0250.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PZIAoec.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pziaoec.wav")) returned 0xffffffff [0250.263] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe236910, ftCreationTime.dwHighDateTime=0x1d5c540, ftLastAccessTime.dwLowDateTime=0xf225d890, ftLastAccessTime.dwHighDateTime=0x1d5bd44, ftLastWriteTime.dwLowDateTime=0xf225d890, ftLastWriteTime.dwHighDateTime=0x1d5bd44, nFileSizeHigh=0x0, nFileSizeLow=0xb216, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="qh4FRo.mp3", cAlternateFileName="")) returned 1 [0250.264] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.264] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29154, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29154) returned 0x10ab [0250.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qh4FRo.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qh4fro.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0250.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\71683446526F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\71683446526f.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.265] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb216 [0250.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0250.265] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0250.354] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb216, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xb216, lpOverlapped=0x0) returned 1 [0250.355] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb220, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xb220, lpOverlapped=0x0) returned 1 [0250.357] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.379] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.410] CloseHandle (hObject=0xf0) returned 1 [0250.410] CloseHandle (hObject=0xf8) returned 1 [0250.410] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qh4FRo.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qh4fro.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\71683446526F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\71683446526f.mp3")) returned 0 [0250.411] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\71683446526F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\71683446526f.mp3")) returned 0x20 [0250.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qh4FRo.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe236910, ftCreationTime.dwHighDateTime=0x1d5c540, ftLastAccessTime.dwLowDateTime=0xf225d890, ftLastAccessTime.dwHighDateTime=0x1d5bd44, ftLastWriteTime.dwLowDateTime=0xf225d890, ftLastWriteTime.dwHighDateTime=0x1d5bd44, nFileSizeHigh=0x0, nFileSizeLow=0xb216, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qh4FRo.mp3", cAlternateFileName="")) returned 0x324f58 [0250.411] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe236910, ftCreationTime.dwHighDateTime=0x1d5c540, ftLastAccessTime.dwLowDateTime=0xf225d890, ftLastAccessTime.dwHighDateTime=0x1d5bd44, ftLastWriteTime.dwLowDateTime=0xf225d890, ftLastWriteTime.dwHighDateTime=0x1d5bd44, nFileSizeHigh=0x0, nFileSizeLow=0xb216, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qh4FRo.mp3", cAlternateFileName="")) returned 0 [0250.411] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0250.411] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qh4FRo.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qh4fro.mp3")) returned 1 [0250.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qh4FRo.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qh4fro.mp3")) returned 0xffffffff [0250.412] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf2c10, ftCreationTime.dwHighDateTime=0x1d5b671, ftLastAccessTime.dwLowDateTime=0x77e2fef0, ftLastAccessTime.dwHighDateTime=0x1d5bdd0, ftLastWriteTime.dwLowDateTime=0x77e2fef0, ftLastWriteTime.dwHighDateTime=0x1d5bdd0, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="qPozJgkRr.wav", cAlternateFileName="QPOZJG~1.WAV")) returned 1 [0250.413] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.413] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.413] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.413] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29154, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.413] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.413] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29154) returned 0x10ab [0250.413] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qPozJgkRr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qpozjgkrr.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\71506F7A4A676B5272.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\71506f7a4a676b5272.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0250.414] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2230 [0250.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0250.415] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0250.486] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x2230, lpOverlapped=0x0) returned 1 [0250.487] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x2240, lpOverlapped=0x0) returned 1 [0250.488] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.511] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.522] CloseHandle (hObject=0xf8) returned 1 [0250.522] CloseHandle (hObject=0xf0) returned 1 [0250.522] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qPozJgkRr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qpozjgkrr.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\71506F7A4A676B5272.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\71506f7a4a676b5272.wav")) returned 0 [0250.523] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\71506F7A4A676B5272.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\71506f7a4a676b5272.wav")) returned 0x20 [0250.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qPozJgkRr.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf2c10, ftCreationTime.dwHighDateTime=0x1d5b671, ftLastAccessTime.dwLowDateTime=0x77e2fef0, ftLastAccessTime.dwHighDateTime=0x1d5bdd0, ftLastWriteTime.dwLowDateTime=0x77e2fef0, ftLastWriteTime.dwHighDateTime=0x1d5bdd0, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qPozJgkRr.wav", cAlternateFileName="QPOZJG~1.WAV")) returned 0x324f58 [0250.523] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf2c10, ftCreationTime.dwHighDateTime=0x1d5b671, ftLastAccessTime.dwLowDateTime=0x77e2fef0, ftLastAccessTime.dwHighDateTime=0x1d5bdd0, ftLastWriteTime.dwLowDateTime=0x77e2fef0, ftLastWriteTime.dwHighDateTime=0x1d5bdd0, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qPozJgkRr.wav", cAlternateFileName="QPOZJG~1.WAV")) returned 0 [0250.523] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0250.523] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qPozJgkRr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qpozjgkrr.wav")) returned 1 [0250.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qPozJgkRr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qpozjgkrr.wav")) returned 0xffffffff [0250.524] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b7fee10, ftCreationTime.dwHighDateTime=0x1d5c286, ftLastAccessTime.dwLowDateTime=0x3ddbd400, ftLastAccessTime.dwHighDateTime=0x1d5be22, ftLastWriteTime.dwLowDateTime=0x3ddbd400, ftLastWriteTime.dwHighDateTime=0x1d5be22, nFileSizeHigh=0x0, nFileSizeLow=0x8121, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="R4XeuO.mp3", cAlternateFileName="")) returned 1 [0250.525] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.525] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291f4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.525] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.525] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291f4) returned 0x10ab [0250.525] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\R4XeuO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r4xeuo.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0250.525] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\52345865754F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\52345865754f.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.526] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8121 [0250.526] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0250.527] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0250.614] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8121, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x8121, lpOverlapped=0x0) returned 1 [0250.615] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x8130, lpOverlapped=0x0) returned 1 [0250.617] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.639] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.649] CloseHandle (hObject=0xf0) returned 1 [0250.649] CloseHandle (hObject=0xf8) returned 1 [0250.649] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\R4XeuO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r4xeuo.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\52345865754F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\52345865754f.mp3")) returned 0 [0250.650] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\52345865754F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\52345865754f.mp3")) returned 0x20 [0250.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\R4XeuO.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b7fee10, ftCreationTime.dwHighDateTime=0x1d5c286, ftLastAccessTime.dwLowDateTime=0x3ddbd400, ftLastAccessTime.dwHighDateTime=0x1d5be22, ftLastWriteTime.dwLowDateTime=0x3ddbd400, ftLastWriteTime.dwHighDateTime=0x1d5be22, nFileSizeHigh=0x0, nFileSizeLow=0x8121, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="R4XeuO.mp3", cAlternateFileName="")) returned 0x324f58 [0250.650] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b7fee10, ftCreationTime.dwHighDateTime=0x1d5c286, ftLastAccessTime.dwLowDateTime=0x3ddbd400, ftLastAccessTime.dwHighDateTime=0x1d5be22, ftLastWriteTime.dwLowDateTime=0x3ddbd400, ftLastWriteTime.dwHighDateTime=0x1d5be22, nFileSizeHigh=0x0, nFileSizeLow=0x8121, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="R4XeuO.mp3", cAlternateFileName="")) returned 0 [0250.651] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0250.651] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\R4XeuO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r4xeuo.mp3")) returned 1 [0250.652] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\R4XeuO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r4xeuo.mp3")) returned 0xffffffff [0250.652] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc501490, ftCreationTime.dwHighDateTime=0x1d5b63e, ftLastAccessTime.dwLowDateTime=0xeda8a050, ftLastAccessTime.dwHighDateTime=0x1d5c504, ftLastWriteTime.dwLowDateTime=0xeda8a050, ftLastWriteTime.dwHighDateTime=0x1d5c504, nFileSizeHigh=0x0, nFileSizeLow=0xde1f, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="rmfT6.mp3", cAlternateFileName="")) returned 1 [0250.652] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.652] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.652] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.653] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29354, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.653] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.653] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29354) returned 0x10ab [0250.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rmfT6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rmft6.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\726D665436.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\726d665436.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0250.654] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde1f [0250.654] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0250.654] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0250.741] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde1f, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xde1f, lpOverlapped=0x0) returned 1 [0250.742] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xde20, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xde20, lpOverlapped=0x0) returned 1 [0250.744] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.766] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.776] CloseHandle (hObject=0xf8) returned 1 [0250.776] CloseHandle (hObject=0xf0) returned 1 [0250.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rmfT6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rmft6.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\726D665436.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\726d665436.mp3")) returned 0 [0250.778] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\726D665436.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\726d665436.mp3")) returned 0x20 [0250.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rmfT6.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc501490, ftCreationTime.dwHighDateTime=0x1d5b63e, ftLastAccessTime.dwLowDateTime=0xeda8a050, ftLastAccessTime.dwHighDateTime=0x1d5c504, ftLastWriteTime.dwLowDateTime=0xeda8a050, ftLastWriteTime.dwHighDateTime=0x1d5c504, nFileSizeHigh=0x0, nFileSizeLow=0xde1f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="rmfT6.mp3", cAlternateFileName="")) returned 0x324f58 [0250.778] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc501490, ftCreationTime.dwHighDateTime=0x1d5b63e, ftLastAccessTime.dwLowDateTime=0xeda8a050, ftLastAccessTime.dwHighDateTime=0x1d5c504, ftLastWriteTime.dwLowDateTime=0xeda8a050, ftLastWriteTime.dwHighDateTime=0x1d5c504, nFileSizeHigh=0x0, nFileSizeLow=0xde1f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="rmfT6.mp3", cAlternateFileName="")) returned 0 [0250.778] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0250.778] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rmfT6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rmft6.mp3")) returned 1 [0250.779] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rmfT6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rmft6.mp3")) returned 0xffffffff [0250.779] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec105080, ftCreationTime.dwHighDateTime=0x1d5baa5, ftLastAccessTime.dwLowDateTime=0x31a99730, ftLastAccessTime.dwHighDateTime=0x1d5bac1, ftLastWriteTime.dwLowDateTime=0x31a99730, ftLastWriteTime.dwHighDateTime=0x1d5bac1, nFileSizeHigh=0x0, nFileSizeLow=0x17b69, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Uhz4.m4a", cAlternateFileName="")) returned 1 [0250.780] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.780] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.780] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.780] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29434, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.780] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.780] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29434) returned 0x10ab [0250.780] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24135220, ftCreationTime.dwHighDateTime=0x1d5bfa6, ftLastAccessTime.dwLowDateTime=0x8ccb1b80, ftLastAccessTime.dwHighDateTime=0x1d5c1ff, ftLastWriteTime.dwLowDateTime=0x8ccb1b80, ftLastWriteTime.dwHighDateTime=0x1d5c1ff, nFileSizeHigh=0x0, nFileSizeLow=0xbebe, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="UN1qEEdr-edc.m4a", cAlternateFileName="UN1QEE~1.M4A")) returned 1 [0250.781] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.781] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.781] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.781] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29500, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.781] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.781] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29500) returned 0x10ab [0250.781] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ae1940, ftCreationTime.dwHighDateTime=0x1d5be94, ftLastAccessTime.dwLowDateTime=0x87160390, ftLastAccessTime.dwHighDateTime=0x1d5ba29, ftLastWriteTime.dwLowDateTime=0x87160390, ftLastWriteTime.dwHighDateTime=0x1d5ba29, nFileSizeHigh=0x0, nFileSizeLow=0x14b2a, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="wcZGIi2sA.m4a", cAlternateFileName="WCZGII~1.M4A")) returned 1 [0250.781] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.781] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.781] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.781] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295c0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.781] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.781] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295c0) returned 0x10ab [0250.782] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6ae30, ftCreationTime.dwHighDateTime=0x1d5c01c, ftLastAccessTime.dwLowDateTime=0x3d93bcc0, ftLastAccessTime.dwHighDateTime=0x1d5b967, ftLastWriteTime.dwLowDateTime=0x3d93bcc0, ftLastWriteTime.dwHighDateTime=0x1d5b967, nFileSizeHigh=0x0, nFileSizeLow=0x16e31, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="WeFgh4O_LHr-p.wav", cAlternateFileName="WEFGH4~1.WAV")) returned 1 [0250.782] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.782] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.782] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.782] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2968c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.782] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.782] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2968c) returned 0x10ab [0250.782] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeFgh4O_LHr-p.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wefgh4o_lhr-p.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0250.782] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5765466768344F5F4C48722D70.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5765466768344f5f4c48722d70.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.784] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16e31 [0250.784] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0250.784] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0250.883] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x16e31, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x16e31, lpOverlapped=0x0) returned 1 [0250.885] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x16e40, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x16e40, lpOverlapped=0x0) returned 1 [0250.888] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.910] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.922] CloseHandle (hObject=0xf0) returned 1 [0250.922] CloseHandle (hObject=0xf8) returned 1 [0250.922] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeFgh4O_LHr-p.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wefgh4o_lhr-p.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5765466768344F5F4C48722D70.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5765466768344f5f4c48722d70.wav")) returned 0 [0250.923] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5765466768344F5F4C48722D70.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5765466768344f5f4c48722d70.wav")) returned 0x20 [0250.923] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeFgh4O_LHr-p.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6ae30, ftCreationTime.dwHighDateTime=0x1d5c01c, ftLastAccessTime.dwLowDateTime=0x3d93bcc0, ftLastAccessTime.dwHighDateTime=0x1d5b967, ftLastWriteTime.dwLowDateTime=0x3d93bcc0, ftLastWriteTime.dwHighDateTime=0x1d5b967, nFileSizeHigh=0x0, nFileSizeLow=0x16e31, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="WeFgh4O_LHr-p.wav", cAlternateFileName="WEFGH4~1.WAV")) returned 0x324f58 [0250.923] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6ae30, ftCreationTime.dwHighDateTime=0x1d5c01c, ftLastAccessTime.dwLowDateTime=0x3d93bcc0, ftLastAccessTime.dwHighDateTime=0x1d5b967, ftLastWriteTime.dwLowDateTime=0x3d93bcc0, ftLastWriteTime.dwHighDateTime=0x1d5b967, nFileSizeHigh=0x0, nFileSizeLow=0x16e31, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="WeFgh4O_LHr-p.wav", cAlternateFileName="WEFGH4~1.WAV")) returned 0 [0250.923] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0250.923] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeFgh4O_LHr-p.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wefgh4o_lhr-p.wav")) returned 1 [0250.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeFgh4O_LHr-p.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wefgh4o_lhr-p.wav")) returned 0xffffffff [0250.925] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc95e2800, ftCreationTime.dwHighDateTime=0x1d5b5a5, ftLastAccessTime.dwLowDateTime=0x18b43020, ftLastAccessTime.dwHighDateTime=0x1d5c0a0, ftLastWriteTime.dwLowDateTime=0x18b43020, ftLastWriteTime.dwHighDateTime=0x1d5c0a0, nFileSizeHigh=0x0, nFileSizeLow=0x10e63, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="wQa4lgXkIXjBslqp.m4a", cAlternateFileName="WQA4LG~1.M4A")) returned 1 [0250.925] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.925] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.926] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.926] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28554, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.926] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.926] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28554) returned 0x10ab [0250.926] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d41ca0, ftCreationTime.dwHighDateTime=0x1d5bdc8, ftLastAccessTime.dwLowDateTime=0x83c744c0, ftLastAccessTime.dwHighDateTime=0x1d5bf6e, ftLastWriteTime.dwLowDateTime=0x83c744c0, ftLastWriteTime.dwHighDateTime=0x1d5bf6e, nFileSizeHigh=0x0, nFileSizeLow=0x4acd, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="YnXIx1YZsG02e9mw.wav", cAlternateFileName="YNXIX1~1.WAV")) returned 1 [0250.926] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0250.926] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.926] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0250.926] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29750, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0250.926] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0250.926] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29750) returned 0x10ab [0250.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YnXIx1YZsG02e9mw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ynxix1yzsg02e9mw.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\596E58497831595A7347303265396D77.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\596e58497831595a7347303265396d77.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0250.927] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4acd [0250.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0250.928] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0251.012] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4acd, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x4acd, lpOverlapped=0x0) returned 1 [0251.014] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x4ad0, lpOverlapped=0x0) returned 1 [0251.015] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.036] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.047] CloseHandle (hObject=0xf8) returned 1 [0251.047] CloseHandle (hObject=0xf0) returned 1 [0251.047] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YnXIx1YZsG02e9mw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ynxix1yzsg02e9mw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\596E58497831595A7347303265396D77.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\596e58497831595a7347303265396d77.wav")) returned 0 [0251.048] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\596E58497831595A7347303265396D77.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\596e58497831595a7347303265396d77.wav")) returned 0x20 [0251.048] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YnXIx1YZsG02e9mw.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d41ca0, ftCreationTime.dwHighDateTime=0x1d5bdc8, ftLastAccessTime.dwLowDateTime=0x83c744c0, ftLastAccessTime.dwHighDateTime=0x1d5bf6e, ftLastWriteTime.dwLowDateTime=0x83c744c0, ftLastWriteTime.dwHighDateTime=0x1d5bf6e, nFileSizeHigh=0x0, nFileSizeLow=0x4acd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="YnXIx1YZsG02e9mw.wav", cAlternateFileName="YNXIX1~1.WAV")) returned 0x324f58 [0251.049] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d41ca0, ftCreationTime.dwHighDateTime=0x1d5bdc8, ftLastAccessTime.dwLowDateTime=0x83c744c0, ftLastAccessTime.dwHighDateTime=0x1d5bf6e, ftLastWriteTime.dwLowDateTime=0x83c744c0, ftLastWriteTime.dwHighDateTime=0x1d5bf6e, nFileSizeHigh=0x0, nFileSizeLow=0x4acd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="YnXIx1YZsG02e9mw.wav", cAlternateFileName="YNXIX1~1.WAV")) returned 0 [0251.049] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0251.049] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YnXIx1YZsG02e9mw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ynxix1yzsg02e9mw.wav")) returned 1 [0251.050] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YnXIx1YZsG02e9mw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ynxix1yzsg02e9mw.wav")) returned 0xffffffff [0251.050] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a91ed0, ftCreationTime.dwHighDateTime=0x1d5c04a, ftLastAccessTime.dwLowDateTime=0xee893840, ftLastAccessTime.dwHighDateTime=0x1d5c5f4, ftLastWriteTime.dwLowDateTime=0xee893840, ftLastWriteTime.dwHighDateTime=0x1d5c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x6479, dwReserved0=0x0, dwReserved1=0x0, cFileName="yTb 7oH.wav", cAlternateFileName="YTB7OH~1.WAV")) returned 1 [0251.050] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.050] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.050] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.050] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c298a0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.050] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.051] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c298a0) returned 0x10ab [0251.051] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\yTb 7oH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ytb 7oh.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0251.051] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\79546220376F48.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\79546220376f48.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.052] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6479 [0251.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0251.052] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0251.123] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6479, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x6479, lpOverlapped=0x0) returned 1 [0251.124] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6480, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x6480, lpOverlapped=0x0) returned 1 [0251.125] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.147] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.157] CloseHandle (hObject=0xf0) returned 1 [0251.157] CloseHandle (hObject=0xf8) returned 1 [0251.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\yTb 7oH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ytb 7oh.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\79546220376F48.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\79546220376f48.wav")) returned 0 [0251.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\79546220376F48.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\79546220376f48.wav")) returned 0x20 [0251.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\yTb 7oH.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a91ed0, ftCreationTime.dwHighDateTime=0x1d5c04a, ftLastAccessTime.dwLowDateTime=0xee893840, ftLastAccessTime.dwHighDateTime=0x1d5c5f4, ftLastWriteTime.dwLowDateTime=0xee893840, ftLastWriteTime.dwHighDateTime=0x1d5c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x6479, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="yTb 7oH.wav", cAlternateFileName="YTB7OH~1.WAV")) returned 0x324f58 [0251.160] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a91ed0, ftCreationTime.dwHighDateTime=0x1d5c04a, ftLastAccessTime.dwLowDateTime=0xee893840, ftLastAccessTime.dwHighDateTime=0x1d5c5f4, ftLastWriteTime.dwLowDateTime=0xee893840, ftLastWriteTime.dwHighDateTime=0x1d5c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x6479, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="yTb 7oH.wav", cAlternateFileName="YTB7OH~1.WAV")) returned 0 [0251.160] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0251.160] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\yTb 7oH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ytb 7oh.wav")) returned 1 [0251.161] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\yTb 7oH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ytb 7oh.wav")) returned 0xffffffff [0251.161] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f344020, ftCreationTime.dwHighDateTime=0x1d5c1e8, ftLastAccessTime.dwLowDateTime=0x1dbe5e0, ftLastAccessTime.dwHighDateTime=0x1d5ba0c, ftLastWriteTime.dwLowDateTime=0x1dbe5e0, ftLastWriteTime.dwHighDateTime=0x1d5ba0c, nFileSizeHigh=0x0, nFileSizeLow=0xe548, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="ZbcRThS69Pyqp0.wav", cAlternateFileName="ZBCRTH~1.WAV")) returned 1 [0251.162] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.162] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.162] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.162] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.162] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.162] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d9c) returned 0x10ab [0251.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZbcRThS69Pyqp0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zbcrths69pyqp0.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5A62635254685336395079717030.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5a62635254685336395079717030.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0251.163] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe548 [0251.163] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0251.164] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0251.248] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe548, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xe548, lpOverlapped=0x0) returned 1 [0251.250] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe550, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xe550, lpOverlapped=0x0) returned 1 [0251.252] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.274] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.284] CloseHandle (hObject=0xf8) returned 1 [0251.284] CloseHandle (hObject=0xf0) returned 1 [0251.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZbcRThS69Pyqp0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zbcrths69pyqp0.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5A62635254685336395079717030.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5a62635254685336395079717030.wav")) returned 0 [0251.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5A62635254685336395079717030.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5a62635254685336395079717030.wav")) returned 0x20 [0251.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZbcRThS69Pyqp0.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f344020, ftCreationTime.dwHighDateTime=0x1d5c1e8, ftLastAccessTime.dwLowDateTime=0x1dbe5e0, ftLastAccessTime.dwHighDateTime=0x1d5ba0c, ftLastWriteTime.dwLowDateTime=0x1dbe5e0, ftLastWriteTime.dwHighDateTime=0x1d5ba0c, nFileSizeHigh=0x0, nFileSizeLow=0xe548, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ZbcRThS69Pyqp0.wav", cAlternateFileName="ZBCRTH~1.WAV")) returned 0x324f58 [0251.285] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f344020, ftCreationTime.dwHighDateTime=0x1d5c1e8, ftLastAccessTime.dwLowDateTime=0x1dbe5e0, ftLastAccessTime.dwHighDateTime=0x1d5ba0c, ftLastWriteTime.dwLowDateTime=0x1dbe5e0, ftLastWriteTime.dwHighDateTime=0x1d5ba0c, nFileSizeHigh=0x0, nFileSizeLow=0xe548, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ZbcRThS69Pyqp0.wav", cAlternateFileName="ZBCRTH~1.WAV")) returned 0 [0251.285] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0251.286] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZbcRThS69Pyqp0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zbcrths69pyqp0.wav")) returned 1 [0251.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZbcRThS69Pyqp0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zbcrths69pyqp0.wav")) returned 0xffffffff [0251.287] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11841770, ftCreationTime.dwHighDateTime=0x1d5c5f0, ftLastAccessTime.dwLowDateTime=0x4a6159c0, ftLastAccessTime.dwHighDateTime=0x1d5b7e7, ftLastWriteTime.dwLowDateTime=0x4a6159c0, ftLastWriteTime.dwHighDateTime=0x1d5b7e7, nFileSizeHigh=0x0, nFileSizeLow=0x5d3b, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="zKIjdEEWld.m4a", cAlternateFileName="ZKIJDE~1.M4A")) returned 1 [0251.287] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.287] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27db0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27db0) returned 0x10ab [0251.288] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7e10fe0, ftCreationTime.dwHighDateTime=0x1d5bc80, ftLastAccessTime.dwLowDateTime=0xf35d8c60, ftLastAccessTime.dwHighDateTime=0x1d5c372, ftLastWriteTime.dwLowDateTime=0xf35d8c60, ftLastWriteTime.dwHighDateTime=0x1d5c372, nFileSizeHigh=0x0, nFileSizeLow=0x97db, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="zpAJ.wav", cAlternateFileName="")) returned 1 [0251.288] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.288] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29a9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.288] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.288] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29a9c) returned 0x10ab [0251.288] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zpAJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zpaj.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0251.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7A70414A.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7a70414a.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.289] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97db [0251.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0251.290] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0251.373] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x97db, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x97db, lpOverlapped=0x0) returned 1 [0251.375] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x97e0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x97e0, lpOverlapped=0x0) returned 1 [0251.376] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.406] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.417] CloseHandle (hObject=0xf0) returned 1 [0251.417] CloseHandle (hObject=0xf8) returned 1 [0251.417] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zpAJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zpaj.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7A70414A.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7a70414a.wav")) returned 0 [0251.425] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7A70414A.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7a70414a.wav")) returned 0x20 [0251.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zpAJ.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7e10fe0, ftCreationTime.dwHighDateTime=0x1d5bc80, ftLastAccessTime.dwLowDateTime=0xf35d8c60, ftLastAccessTime.dwHighDateTime=0x1d5c372, ftLastWriteTime.dwLowDateTime=0xf35d8c60, ftLastWriteTime.dwHighDateTime=0x1d5c372, nFileSizeHigh=0x0, nFileSizeLow=0x97db, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="zpAJ.wav", cAlternateFileName="")) returned 0x324f58 [0251.425] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7e10fe0, ftCreationTime.dwHighDateTime=0x1d5bc80, ftLastAccessTime.dwLowDateTime=0xf35d8c60, ftLastAccessTime.dwHighDateTime=0x1d5c372, ftLastWriteTime.dwLowDateTime=0xf35d8c60, ftLastWriteTime.dwHighDateTime=0x1d5c372, nFileSizeHigh=0x0, nFileSizeLow=0x97db, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="zpAJ.wav", cAlternateFileName="")) returned 0 [0251.425] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0251.425] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zpAJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zpaj.wav")) returned 1 [0251.426] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zpAJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zpaj.wav")) returned 0xffffffff [0251.426] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f60ab70, ftCreationTime.dwHighDateTime=0x1d5c082, ftLastAccessTime.dwLowDateTime=0xfc230be0, ftLastAccessTime.dwHighDateTime=0x1d5bc92, ftLastWriteTime.dwLowDateTime=0xfc230be0, ftLastWriteTime.dwHighDateTime=0x1d5bc92, nFileSizeHigh=0x0, nFileSizeLow=0x4fa6, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="ZVCJV5Eqi4K.mp3", cAlternateFileName="ZVCJV5~1.MP3")) returned 1 [0251.427] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.427] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.427] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.427] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.427] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.427] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.427] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0251.427] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.428] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZVCJV5Eqi4K.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zvcjv5eqi4k.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.428] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5A56434A5635457169344B.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5a56434a5635457169344b.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0251.429] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fa6 [0251.429] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0251.429] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0251.505] ReadFile (in: hFile=0xf8, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4fa6, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x4fa6, lpOverlapped=0x0) returned 1 [0251.506] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4fb0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x4fb0, lpOverlapped=0x0) returned 1 [0251.507] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.529] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.540] CloseHandle (hObject=0xf8) returned 1 [0251.540] CloseHandle (hObject=0xf0) returned 1 [0251.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZVCJV5Eqi4K.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zvcjv5eqi4k.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5A56434A5635457169344B.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5a56434a5635457169344b.mp3")) returned 0 [0251.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5A56434A5635457169344B.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5a56434a5635457169344b.mp3")) returned 0x20 [0251.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZVCJV5Eqi4K.mp3", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f60ab70, ftCreationTime.dwHighDateTime=0x1d5c082, ftLastAccessTime.dwLowDateTime=0xfc230be0, ftLastAccessTime.dwHighDateTime=0x1d5bc92, ftLastWriteTime.dwLowDateTime=0xfc230be0, ftLastWriteTime.dwHighDateTime=0x1d5bc92, nFileSizeHigh=0x0, nFileSizeLow=0x4fa6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ZVCJV5Eqi4K.mp3", cAlternateFileName="ZVCJV5~1.MP3")) returned 0x324f58 [0251.541] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f60ab70, ftCreationTime.dwHighDateTime=0x1d5c082, ftLastAccessTime.dwLowDateTime=0xfc230be0, ftLastAccessTime.dwHighDateTime=0x1d5bc92, ftLastWriteTime.dwLowDateTime=0xfc230be0, ftLastWriteTime.dwHighDateTime=0x1d5bc92, nFileSizeHigh=0x0, nFileSizeLow=0x4fa6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ZVCJV5Eqi4K.mp3", cAlternateFileName="ZVCJV5~1.MP3")) returned 0 [0251.541] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0251.541] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZVCJV5Eqi4K.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zvcjv5eqi4k.mp3")) returned 1 [0251.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZVCJV5Eqi4K.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zvcjv5eqi4k.mp3")) returned 0xffffffff [0251.542] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca26be60, ftCreationTime.dwHighDateTime=0x1d5b8f6, ftLastAccessTime.dwLowDateTime=0xfe7e96b0, ftLastAccessTime.dwHighDateTime=0x1d5b6c1, ftLastWriteTime.dwLowDateTime=0xfe7e96b0, ftLastWriteTime.dwHighDateTime=0x1d5b6c1, nFileSizeHigh=0x0, nFileSizeLow=0x33df, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_oNCX28uOPgKS.wav", cAlternateFileName="_ONCX2~1.WAV")) returned 1 [0251.543] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.543] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.543] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.543] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.543] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e3c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.543] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.544] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e3c) returned 0x10ab [0251.544] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.544] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_oNCX28uOPgKS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_oncx28uopgks.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0251.544] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5F6F4E43583238754F50674B53.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5f6f4e43583238754f50674b53.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.545] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33df [0251.545] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0251.545] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0251.642] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x33df, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x33df, lpOverlapped=0x0) returned 1 [0251.643] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x33e0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x33e0, lpOverlapped=0x0) returned 1 [0251.644] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.666] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.677] CloseHandle (hObject=0xf0) returned 1 [0251.677] CloseHandle (hObject=0xf8) returned 1 [0251.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_oNCX28uOPgKS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_oncx28uopgks.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5F6F4E43583238754F50674B53.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5f6f4e43583238754f50674b53.wav")) returned 0 [0251.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5F6F4E43583238754F50674B53.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5f6f4e43583238754f50674b53.wav")) returned 0x20 [0251.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_oNCX28uOPgKS.wav", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca26be60, ftCreationTime.dwHighDateTime=0x1d5b8f6, ftLastAccessTime.dwLowDateTime=0xfe7e96b0, ftLastAccessTime.dwHighDateTime=0x1d5b6c1, ftLastWriteTime.dwLowDateTime=0xfe7e96b0, ftLastWriteTime.dwHighDateTime=0x1d5b6c1, nFileSizeHigh=0x0, nFileSizeLow=0x33df, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_oNCX28uOPgKS.wav", cAlternateFileName="_ONCX2~1.WAV")) returned 0x324f58 [0251.687] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca26be60, ftCreationTime.dwHighDateTime=0x1d5b8f6, ftLastAccessTime.dwLowDateTime=0xfe7e96b0, ftLastAccessTime.dwHighDateTime=0x1d5b6c1, ftLastWriteTime.dwLowDateTime=0xfe7e96b0, ftLastWriteTime.dwHighDateTime=0x1d5b6c1, nFileSizeHigh=0x0, nFileSizeLow=0x33df, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_oNCX28uOPgKS.wav", cAlternateFileName="_ONCX2~1.WAV")) returned 0 [0251.687] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0251.687] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_oNCX28uOPgKS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_oncx28uopgks.wav")) returned 1 [0251.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_oNCX28uOPgKS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_oncx28uopgks.wav")) returned 0xffffffff [0251.688] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca26be60, ftCreationTime.dwHighDateTime=0x1d5b8f6, ftLastAccessTime.dwLowDateTime=0xfe7e96b0, ftLastAccessTime.dwHighDateTime=0x1d5b6c1, ftLastWriteTime.dwLowDateTime=0xfe7e96b0, ftLastWriteTime.dwHighDateTime=0x1d5b6c1, nFileSizeHigh=0x0, nFileSizeLow=0x33df, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_oNCX28uOPgKS.wav", cAlternateFileName="_ONCX2~1.WAV")) returned 0 [0251.688] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0251.688] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61767661, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0251.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca26be60, ftCreationTime.dwHighDateTime=0x1d5b8f6, ftLastAccessTime.dwLowDateTime=0xfe7e96b0, ftLastAccessTime.dwHighDateTime=0x1d5b6c1, ftLastWriteTime.dwLowDateTime=0xfe7e96b0, ftLastWriteTime.dwHighDateTime=0x1d5b6c1, nFileSizeHigh=0x0, nFileSizeLow=0x33df, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_oNCX28uOPgKS.wav", cAlternateFileName="°³1")) returned 0xffffffff [0251.688] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61767661, cFileName="NetHood", cAlternateFileName="")) returned 1 [0251.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca26be60, ftCreationTime.dwHighDateTime=0x1d5b8f6, ftLastAccessTime.dwLowDateTime=0xfe7e96b0, ftLastAccessTime.dwHighDateTime=0x1d5b6c1, ftLastWriteTime.dwLowDateTime=0xfe7e96b0, ftLastWriteTime.dwHighDateTime=0x1d5b6c1, nFileSizeHigh=0x0, nFileSizeLow=0x33df, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_oNCX28uOPgKS.wav", cAlternateFileName="°³1")) returned 0xffffffff [0251.688] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x61767661, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0251.689] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.689] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.689] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d60, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.689] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.689] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d60) returned 0x10ab [0251.690] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.690] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x18f6a8, dwReserved1=0x18f6c4, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0251.690] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.690] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.690] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d60, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.690] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.690] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d60) returned 0x10ab [0251.691] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.691] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f6a8, dwReserved1=0x18f6c4, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0251.691] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.691] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.691] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.691] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.691] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d60, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.691] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.691] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d60) returned 0x10ab [0251.692] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.692] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18f6a8, dwReserved1=0x18f6c4, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0251.692] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.692] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.692] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.692] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.692] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.693] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.693] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc4) returned 0x10ab [0251.693] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.693] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x18f6a8, dwReserved1=0x18f6c4, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0251.693] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.693] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.693] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.693] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.694] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.694] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.694] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e4c) returned 0x10ab [0251.694] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.694] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x18f6a8, dwReserved1=0x18f6c4, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0251.694] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.694] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.694] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.694] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.695] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ed4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.695] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.695] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ed4) returned 0x10ab [0251.695] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.695] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x18f6a8, dwReserved1=0x18f6c4, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0251.695] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.695] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.695] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.695] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.696] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d60, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.696] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.696] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d60) returned 0x10ab [0251.696] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0251.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\6E7475736572.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\6e7475736572.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.697] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14 [0251.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0251.697] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0251.786] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f770*=0x14, lpOverlapped=0x0) returned 1 [0251.787] WriteFile (in: hFile=0xf8, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f770*=0x20, lpOverlapped=0x0) returned 1 [0251.788] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.809] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.819] CloseHandle (hObject=0xec) returned 1 [0251.820] CloseHandle (hObject=0xf8) returned 1 [0251.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\6E7475736572.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\6e7475736572.ini")) returned 0 [0251.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\6E7475736572.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\6e7475736572.ini")) returned 0x20 [0251.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ntuser.ini", cAlternateFileName="")) returned 0x324f18 [0251.821] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ntuser.ini", cAlternateFileName="")) returned 0 [0251.821] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0251.821] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini")) returned 1 [0251.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini")) returned 0xffffffff [0251.822] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f61b150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f61b150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758acb3, cFileName="Pictures", cAlternateFileName="")) returned 1 [0251.822] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f61b150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f61b150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520050, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0251.822] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f61b150, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f61b150, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520050, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0251.822] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f302030, ftCreationTime.dwHighDateTime=0x1d5bd62, ftLastAccessTime.dwLowDateTime=0x46e41a70, ftLastAccessTime.dwHighDateTime=0x1d5bac7, ftLastWriteTime.dwLowDateTime=0x46e41a70, ftLastWriteTime.dwHighDateTime=0x1d5bac7, nFileSizeHigh=0x0, nFileSizeLow=0x146b5, dwReserved0=0x520050, dwReserved1=0x31c7b8, cFileName="4EE4dVh2B.bmp", cAlternateFileName="4EE4DV~1.BMP")) returned 1 [0251.822] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.822] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.822] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.822] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.823] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27cfc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.823] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.823] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27cfc) returned 0x10ab [0251.823] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EE4dVh2B.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4ee4dvh2b.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0251.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\344545346456683242.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\344545346456683242.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0251.825] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x146b5 [0251.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0251.825] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0251.920] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x146b5, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x146b5, lpOverlapped=0x0) returned 1 [0251.923] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x146c0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x146c0, lpOverlapped=0x0) returned 1 [0251.925] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.947] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.958] CloseHandle (hObject=0xec) returned 1 [0251.958] CloseHandle (hObject=0xf0) returned 1 [0251.958] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EE4dVh2B.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4ee4dvh2b.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\344545346456683242.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\344545346456683242.bmp")) returned 0 [0251.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\344545346456683242.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\344545346456683242.bmp")) returned 0x20 [0251.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EE4dVh2B.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f302030, ftCreationTime.dwHighDateTime=0x1d5bd62, ftLastAccessTime.dwLowDateTime=0x46e41a70, ftLastAccessTime.dwHighDateTime=0x1d5bac7, ftLastWriteTime.dwLowDateTime=0x46e41a70, ftLastWriteTime.dwHighDateTime=0x1d5bac7, nFileSizeHigh=0x0, nFileSizeLow=0x146b5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="4EE4dVh2B.bmp", cAlternateFileName="4EE4DV~1.BMP")) returned 0x324f58 [0251.959] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f302030, ftCreationTime.dwHighDateTime=0x1d5bd62, ftLastAccessTime.dwLowDateTime=0x46e41a70, ftLastAccessTime.dwHighDateTime=0x1d5bac7, ftLastWriteTime.dwLowDateTime=0x46e41a70, ftLastWriteTime.dwHighDateTime=0x1d5bac7, nFileSizeHigh=0x0, nFileSizeLow=0x146b5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="4EE4dVh2B.bmp", cAlternateFileName="4EE4DV~1.BMP")) returned 0 [0251.959] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0251.959] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EE4dVh2B.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4ee4dvh2b.bmp")) returned 1 [0251.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EE4dVh2B.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4ee4dvh2b.bmp")) returned 0xffffffff [0251.961] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f27930, ftCreationTime.dwHighDateTime=0x1d5b720, ftLastAccessTime.dwLowDateTime=0xbd390000, ftLastAccessTime.dwHighDateTime=0x1d5be78, ftLastWriteTime.dwLowDateTime=0xbd390000, ftLastWriteTime.dwHighDateTime=0x1d5be78, nFileSizeHigh=0x0, nFileSizeLow=0x12982, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="4EK0YGd0czcHbhZG.gif", cAlternateFileName="4EK0YG~1.GIF")) returned 1 [0251.962] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0251.962] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.962] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0251.962] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0251.963] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0251.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0251.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d48) returned 0x10ab [0251.963] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0251.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EK0YGd0czcHbhZG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4ek0ygd0czchbhzg.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0251.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\34454B3059476430637A634862685A47.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\34454b3059476430637a634862685a47.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0251.964] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12982 [0251.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0251.964] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0252.034] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12982, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x12982, lpOverlapped=0x0) returned 1 [0252.036] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12990, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x12990, lpOverlapped=0x0) returned 1 [0252.038] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.071] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.082] CloseHandle (hObject=0xf0) returned 1 [0252.083] CloseHandle (hObject=0xec) returned 1 [0252.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EK0YGd0czcHbhZG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4ek0ygd0czchbhzg.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\34454B3059476430637A634862685A47.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\34454b3059476430637a634862685a47.gif")) returned 0 [0252.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\34454B3059476430637A634862685A47.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\34454b3059476430637a634862685a47.gif")) returned 0x20 [0252.086] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EK0YGd0czcHbhZG.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f27930, ftCreationTime.dwHighDateTime=0x1d5b720, ftLastAccessTime.dwLowDateTime=0xbd390000, ftLastAccessTime.dwHighDateTime=0x1d5be78, ftLastWriteTime.dwLowDateTime=0xbd390000, ftLastWriteTime.dwHighDateTime=0x1d5be78, nFileSizeHigh=0x0, nFileSizeLow=0x12982, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4EK0YGd0czcHbhZG.gif", cAlternateFileName="4EK0YG~1.GIF")) returned 0x324f58 [0252.086] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f27930, ftCreationTime.dwHighDateTime=0x1d5b720, ftLastAccessTime.dwLowDateTime=0xbd390000, ftLastAccessTime.dwHighDateTime=0x1d5be78, ftLastWriteTime.dwLowDateTime=0xbd390000, ftLastWriteTime.dwHighDateTime=0x1d5be78, nFileSizeHigh=0x0, nFileSizeLow=0x12982, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="4EK0YGd0czcHbhZG.gif", cAlternateFileName="4EK0YG~1.GIF")) returned 0 [0252.086] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0252.086] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EK0YGd0czcHbhZG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4ek0ygd0czchbhzg.gif")) returned 1 [0252.090] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4EK0YGd0czcHbhZG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4ek0ygd0czchbhzg.gif")) returned 0xffffffff [0252.090] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a31ce50, ftCreationTime.dwHighDateTime=0x1d5c5b5, ftLastAccessTime.dwLowDateTime=0x550d3e90, ftLastAccessTime.dwHighDateTime=0x1d5bf83, ftLastWriteTime.dwLowDateTime=0x550d3e90, ftLastWriteTime.dwHighDateTime=0x1d5bf83, nFileSizeHigh=0x0, nFileSizeLow=0x140aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="4JFaLMRc_pxE7T5y6Ua.jpg", cAlternateFileName="4JFALM~1.JPG")) returned 1 [0252.091] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0252.091] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.091] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0252.091] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0252.092] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0252.092] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.092] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc0) returned 0x10ab [0252.092] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0252.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4JFaLMRc_pxE7T5y6Ua.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4jfalmrc_pxe7t5y6ua.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\344A46614C4D52635F70784537543579365561.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\344a46614c4d52635f70784537543579365561.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0252.093] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140aa [0252.094] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0252.094] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0252.183] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x140aa, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x140aa, lpOverlapped=0x0) returned 1 [0252.186] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x140b0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x140b0, lpOverlapped=0x0) returned 1 [0252.188] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.210] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.221] CloseHandle (hObject=0xec) returned 1 [0252.221] CloseHandle (hObject=0xf0) returned 1 [0252.221] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4JFaLMRc_pxE7T5y6Ua.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4jfalmrc_pxe7t5y6ua.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\344A46614C4D52635F70784537543579365561.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\344a46614c4d52635f70784537543579365561.jpg")) returned 0 [0252.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\344A46614C4D52635F70784537543579365561.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\344a46614c4d52635f70784537543579365561.jpg")) returned 0x20 [0252.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4JFaLMRc_pxE7T5y6Ua.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a31ce50, ftCreationTime.dwHighDateTime=0x1d5c5b5, ftLastAccessTime.dwLowDateTime=0x550d3e90, ftLastAccessTime.dwHighDateTime=0x1d5bf83, ftLastWriteTime.dwLowDateTime=0x550d3e90, ftLastWriteTime.dwHighDateTime=0x1d5bf83, nFileSizeHigh=0x0, nFileSizeLow=0x140aa, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="4JFaLMRc_pxE7T5y6Ua.jpg", cAlternateFileName="4JFALM~1.JPG")) returned 0x324f58 [0252.222] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a31ce50, ftCreationTime.dwHighDateTime=0x1d5c5b5, ftLastAccessTime.dwLowDateTime=0x550d3e90, ftLastAccessTime.dwHighDateTime=0x1d5bf83, ftLastWriteTime.dwLowDateTime=0x550d3e90, ftLastWriteTime.dwHighDateTime=0x1d5bf83, nFileSizeHigh=0x0, nFileSizeLow=0x140aa, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="4JFaLMRc_pxE7T5y6Ua.jpg", cAlternateFileName="4JFALM~1.JPG")) returned 0 [0252.222] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0252.222] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4JFaLMRc_pxE7T5y6Ua.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4jfalmrc_pxe7t5y6ua.jpg")) returned 1 [0252.224] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4JFaLMRc_pxE7T5y6Ua.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4jfalmrc_pxe7t5y6ua.jpg")) returned 0xffffffff [0252.224] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedb163f0, ftCreationTime.dwHighDateTime=0x1d5c5f6, ftLastAccessTime.dwLowDateTime=0x51fdf800, ftLastAccessTime.dwHighDateTime=0x1d5b80a, ftLastWriteTime.dwLowDateTime=0x51fdf800, ftLastWriteTime.dwHighDateTime=0x1d5b80a, nFileSizeHigh=0x0, nFileSizeLow=0xe058, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="5c2wSx_Gnv.bmp", cAlternateFileName="5C2WSX~1.BMP")) returned 1 [0252.225] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0252.225] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.225] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0252.225] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0252.225] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0252.225] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.225] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d84) returned 0x10ab [0252.225] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0252.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5c2wSx_Gnv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5c2wsx_gnv.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0252.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3563327753785F476E76.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3563327753785f476e76.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.226] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe058 [0252.226] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0252.227] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0252.314] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe058, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xe058, lpOverlapped=0x0) returned 1 [0252.315] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe060, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xe060, lpOverlapped=0x0) returned 1 [0252.317] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.339] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.350] CloseHandle (hObject=0xf0) returned 1 [0252.350] CloseHandle (hObject=0xec) returned 1 [0252.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5c2wSx_Gnv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5c2wsx_gnv.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3563327753785F476E76.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3563327753785f476e76.bmp")) returned 0 [0252.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3563327753785F476E76.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3563327753785f476e76.bmp")) returned 0x20 [0252.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5c2wSx_Gnv.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedb163f0, ftCreationTime.dwHighDateTime=0x1d5c5f6, ftLastAccessTime.dwLowDateTime=0x51fdf800, ftLastAccessTime.dwHighDateTime=0x1d5b80a, ftLastWriteTime.dwLowDateTime=0x51fdf800, ftLastWriteTime.dwHighDateTime=0x1d5b80a, nFileSizeHigh=0x0, nFileSizeLow=0xe058, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5c2wSx_Gnv.bmp", cAlternateFileName="5C2WSX~1.BMP")) returned 0x324f58 [0252.351] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedb163f0, ftCreationTime.dwHighDateTime=0x1d5c5f6, ftLastAccessTime.dwLowDateTime=0x51fdf800, ftLastAccessTime.dwHighDateTime=0x1d5b80a, ftLastWriteTime.dwLowDateTime=0x51fdf800, ftLastWriteTime.dwHighDateTime=0x1d5b80a, nFileSizeHigh=0x0, nFileSizeLow=0xe058, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="5c2wSx_Gnv.bmp", cAlternateFileName="5C2WSX~1.BMP")) returned 0 [0252.351] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0252.351] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5c2wSx_Gnv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5c2wsx_gnv.bmp")) returned 1 [0252.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5c2wSx_Gnv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5c2wsx_gnv.bmp")) returned 0xffffffff [0252.353] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28e5bf0, ftCreationTime.dwHighDateTime=0x1d5c464, ftLastAccessTime.dwLowDateTime=0x8aceaf70, ftLastAccessTime.dwHighDateTime=0x1d5bad1, ftLastWriteTime.dwLowDateTime=0x8aceaf70, ftLastWriteTime.dwHighDateTime=0x1d5bad1, nFileSizeHigh=0x0, nFileSizeLow=0x897a, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="7C-aFh QQPi3zN6R9eF.png", cAlternateFileName="7C-AFH~1.PNG")) returned 1 [0252.354] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0252.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0252.354] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0252.354] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d84, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0252.354] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.354] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d84) returned 0x10ab [0252.354] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0252.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7C-aFh QQPi3zN6R9eF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7c-afh qqpi3zn6r9ef.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\37432D6146682051515069337A4E3652396546.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\37432d6146682051515069337a4e3652396546.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0252.356] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x897a [0252.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0252.356] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0252.460] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x897a, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x897a, lpOverlapped=0x0) returned 1 [0252.461] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8980, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x8980, lpOverlapped=0x0) returned 1 [0252.463] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.485] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.496] CloseHandle (hObject=0xec) returned 1 [0252.496] CloseHandle (hObject=0xf0) returned 1 [0252.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7C-aFh QQPi3zN6R9eF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7c-afh qqpi3zn6r9ef.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\37432D6146682051515069337A4E3652396546.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\37432d6146682051515069337a4e3652396546.png")) returned 0 [0252.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\37432D6146682051515069337A4E3652396546.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\37432d6146682051515069337a4e3652396546.png")) returned 0x20 [0252.497] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7C-aFh QQPi3zN6R9eF.png", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28e5bf0, ftCreationTime.dwHighDateTime=0x1d5c464, ftLastAccessTime.dwLowDateTime=0x8aceaf70, ftLastAccessTime.dwHighDateTime=0x1d5bad1, ftLastWriteTime.dwLowDateTime=0x8aceaf70, ftLastWriteTime.dwHighDateTime=0x1d5bad1, nFileSizeHigh=0x0, nFileSizeLow=0x897a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7C-aFh QQPi3zN6R9eF.png", cAlternateFileName="7C-AFH~1.PNG")) returned 0x324f58 [0252.497] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28e5bf0, ftCreationTime.dwHighDateTime=0x1d5c464, ftLastAccessTime.dwLowDateTime=0x8aceaf70, ftLastAccessTime.dwHighDateTime=0x1d5bad1, ftLastWriteTime.dwLowDateTime=0x8aceaf70, ftLastWriteTime.dwHighDateTime=0x1d5bad1, nFileSizeHigh=0x0, nFileSizeLow=0x897a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7C-aFh QQPi3zN6R9eF.png", cAlternateFileName="7C-AFH~1.PNG")) returned 0 [0252.497] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0252.497] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7C-aFh QQPi3zN6R9eF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7c-afh qqpi3zn6r9ef.png")) returned 1 [0252.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7C-aFh QQPi3zN6R9eF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7c-afh qqpi3zn6r9ef.png")) returned 0xffffffff [0252.499] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x719351e0, ftCreationTime.dwHighDateTime=0x1d5b8b1, ftLastAccessTime.dwLowDateTime=0x9bffd0d0, ftLastAccessTime.dwHighDateTime=0x1d5b6e4, ftLastWriteTime.dwLowDateTime=0x9bffd0d0, ftLastWriteTime.dwHighDateTime=0x1d5b6e4, nFileSizeHigh=0x0, nFileSizeLow=0x103fd, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="7HyWHuTssV4pmrL.gif", cAlternateFileName="7HYWHU~1.GIF")) returned 1 [0252.499] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0252.499] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.499] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0252.499] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0252.500] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0252.500] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.500] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc8) returned 0x10ab [0252.500] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0252.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7HyWHuTssV4pmrL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7hywhutssv4pmrl.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0252.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3748795748755473735634706D724C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3748795748755473735634706d724c.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.501] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103fd [0252.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0252.501] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0252.588] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x103fd, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x103fd, lpOverlapped=0x0) returned 1 [0252.590] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10400, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x10400, lpOverlapped=0x0) returned 1 [0252.592] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.614] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.625] CloseHandle (hObject=0xf0) returned 1 [0252.625] CloseHandle (hObject=0xec) returned 1 [0252.625] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7HyWHuTssV4pmrL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7hywhutssv4pmrl.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3748795748755473735634706D724C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3748795748755473735634706d724c.gif")) returned 0 [0252.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3748795748755473735634706D724C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3748795748755473735634706d724c.gif")) returned 0x20 [0252.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7HyWHuTssV4pmrL.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x719351e0, ftCreationTime.dwHighDateTime=0x1d5b8b1, ftLastAccessTime.dwLowDateTime=0x9bffd0d0, ftLastAccessTime.dwHighDateTime=0x1d5b6e4, ftLastWriteTime.dwLowDateTime=0x9bffd0d0, ftLastWriteTime.dwHighDateTime=0x1d5b6e4, nFileSizeHigh=0x0, nFileSizeLow=0x103fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7HyWHuTssV4pmrL.gif", cAlternateFileName="7HYWHU~1.GIF")) returned 0x324f58 [0252.626] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x719351e0, ftCreationTime.dwHighDateTime=0x1d5b8b1, ftLastAccessTime.dwLowDateTime=0x9bffd0d0, ftLastAccessTime.dwHighDateTime=0x1d5b6e4, ftLastWriteTime.dwLowDateTime=0x9bffd0d0, ftLastWriteTime.dwHighDateTime=0x1d5b6e4, nFileSizeHigh=0x0, nFileSizeLow=0x103fd, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="7HyWHuTssV4pmrL.gif", cAlternateFileName="7HYWHU~1.GIF")) returned 0 [0252.626] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0252.626] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7HyWHuTssV4pmrL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7hywhutssv4pmrl.gif")) returned 1 [0252.628] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7HyWHuTssV4pmrL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7hywhutssv4pmrl.gif")) returned 0xffffffff [0252.629] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6acd40, ftCreationTime.dwHighDateTime=0x1d5bc05, ftLastAccessTime.dwLowDateTime=0x569aace0, ftLastAccessTime.dwHighDateTime=0x1d5c3d7, ftLastWriteTime.dwLowDateTime=0x569aace0, ftLastWriteTime.dwHighDateTime=0x1d5c3d7, nFileSizeHigh=0x0, nFileSizeLow=0xfc33, dwReserved0=0x0, dwReserved1=0x0, cFileName="80LrehEN.jpg", cAlternateFileName="")) returned 1 [0252.629] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0252.629] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.629] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0252.629] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0252.630] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0252.630] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.630] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d08) returned 0x10ab [0252.630] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0252.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\80LrehEN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\80lrehen.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\38304C726568454E.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\38304c726568454e.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0252.631] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc33 [0252.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0252.631] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0252.717] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfc33, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xfc33, lpOverlapped=0x0) returned 1 [0252.719] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xfc40, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xfc40, lpOverlapped=0x0) returned 1 [0252.720] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.742] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.753] CloseHandle (hObject=0xec) returned 1 [0252.753] CloseHandle (hObject=0xf0) returned 1 [0252.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\80LrehEN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\80lrehen.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\38304C726568454E.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\38304c726568454e.jpg")) returned 0 [0252.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\38304C726568454E.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\38304c726568454e.jpg")) returned 0x20 [0252.754] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\80LrehEN.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6acd40, ftCreationTime.dwHighDateTime=0x1d5bc05, ftLastAccessTime.dwLowDateTime=0x569aace0, ftLastAccessTime.dwHighDateTime=0x1d5c3d7, ftLastWriteTime.dwLowDateTime=0x569aace0, ftLastWriteTime.dwHighDateTime=0x1d5c3d7, nFileSizeHigh=0x0, nFileSizeLow=0xfc33, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="80LrehEN.jpg", cAlternateFileName="")) returned 0x324f58 [0252.754] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6acd40, ftCreationTime.dwHighDateTime=0x1d5bc05, ftLastAccessTime.dwLowDateTime=0x569aace0, ftLastAccessTime.dwHighDateTime=0x1d5c3d7, ftLastWriteTime.dwLowDateTime=0x569aace0, ftLastWriteTime.dwHighDateTime=0x1d5c3d7, nFileSizeHigh=0x0, nFileSizeLow=0xfc33, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="80LrehEN.jpg", cAlternateFileName="")) returned 0 [0252.754] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0252.755] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\80LrehEN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\80lrehen.jpg")) returned 1 [0252.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\80LrehEN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\80lrehen.jpg")) returned 0xffffffff [0252.756] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf44b2360, ftCreationTime.dwHighDateTime=0x1d5bd61, ftLastAccessTime.dwLowDateTime=0xe8f034e0, ftLastAccessTime.dwHighDateTime=0x1d5b5fc, ftLastWriteTime.dwLowDateTime=0xe8f034e0, ftLastWriteTime.dwHighDateTime=0x1d5b5fc, nFileSizeHigh=0x0, nFileSizeLow=0xbc27, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="8vKONknDwA.png", cAlternateFileName="8VKONK~1.PNG")) returned 1 [0252.757] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0252.757] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.757] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0252.757] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0252.758] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d34, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0252.758] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.758] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d34) returned 0x10ab [0252.758] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0252.758] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8vKONknDwA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8vkonkndwa.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0252.758] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\38764B4F4E6B6E447741.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\38764b4f4e6b6e447741.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.764] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc27 [0252.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0252.764] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0252.838] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbc27, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xbc27, lpOverlapped=0x0) returned 1 [0252.839] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbc30, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xbc30, lpOverlapped=0x0) returned 1 [0252.841] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.864] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.883] CloseHandle (hObject=0xf0) returned 1 [0252.883] CloseHandle (hObject=0xec) returned 1 [0252.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8vKONknDwA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8vkonkndwa.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\38764B4F4E6B6E447741.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\38764b4f4e6b6e447741.png")) returned 0 [0252.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\38764B4F4E6B6E447741.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\38764b4f4e6b6e447741.png")) returned 0x20 [0252.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8vKONknDwA.png", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf44b2360, ftCreationTime.dwHighDateTime=0x1d5bd61, ftLastAccessTime.dwLowDateTime=0xe8f034e0, ftLastAccessTime.dwHighDateTime=0x1d5b5fc, ftLastWriteTime.dwLowDateTime=0xe8f034e0, ftLastWriteTime.dwHighDateTime=0x1d5b5fc, nFileSizeHigh=0x0, nFileSizeLow=0xbc27, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8vKONknDwA.png", cAlternateFileName="8VKONK~1.PNG")) returned 0x324f58 [0252.885] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf44b2360, ftCreationTime.dwHighDateTime=0x1d5bd61, ftLastAccessTime.dwLowDateTime=0xe8f034e0, ftLastAccessTime.dwHighDateTime=0x1d5b5fc, ftLastWriteTime.dwLowDateTime=0xe8f034e0, ftLastWriteTime.dwHighDateTime=0x1d5b5fc, nFileSizeHigh=0x0, nFileSizeLow=0xbc27, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="8vKONknDwA.png", cAlternateFileName="8VKONK~1.PNG")) returned 0 [0252.885] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0252.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8vKONknDwA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8vkonkndwa.png")) returned 1 [0252.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8vKONknDwA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8vkonkndwa.png")) returned 0xffffffff [0252.887] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f745c0, ftCreationTime.dwHighDateTime=0x1d5c10a, ftLastAccessTime.dwLowDateTime=0x30e3c740, ftLastAccessTime.dwHighDateTime=0x1d5bd13, ftLastWriteTime.dwLowDateTime=0x30e3c740, ftLastWriteTime.dwHighDateTime=0x1d5bd13, nFileSizeHigh=0x0, nFileSizeLow=0x11fba, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Bct_Jx38ipMudu.png", cAlternateFileName="BCT_JX~1.PNG")) returned 1 [0252.887] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0252.888] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.888] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0252.888] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0252.888] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0252.888] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0252.888] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dac) returned 0x10ab [0252.888] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0252.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Bct_Jx38ipMudu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bct_jx38ipmudu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4263745F4A78333869704D756475.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4263745f4a78333869704d756475.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0252.889] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11fba [0252.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0252.890] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0252.977] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11fba, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x11fba, lpOverlapped=0x0) returned 1 [0252.979] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x11fc0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x11fc0, lpOverlapped=0x0) returned 1 [0252.981] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.003] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.014] CloseHandle (hObject=0xec) returned 1 [0253.014] CloseHandle (hObject=0xf0) returned 1 [0253.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Bct_Jx38ipMudu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bct_jx38ipmudu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4263745F4A78333869704D756475.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4263745f4a78333869704d756475.png")) returned 0 [0253.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4263745F4A78333869704D756475.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4263745f4a78333869704d756475.png")) returned 0x20 [0253.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Bct_Jx38ipMudu.png", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f745c0, ftCreationTime.dwHighDateTime=0x1d5c10a, ftLastAccessTime.dwLowDateTime=0x30e3c740, ftLastAccessTime.dwHighDateTime=0x1d5bd13, ftLastWriteTime.dwLowDateTime=0x30e3c740, ftLastWriteTime.dwHighDateTime=0x1d5bd13, nFileSizeHigh=0x0, nFileSizeLow=0x11fba, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Bct_Jx38ipMudu.png", cAlternateFileName="BCT_JX~1.PNG")) returned 0x324f58 [0253.016] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f745c0, ftCreationTime.dwHighDateTime=0x1d5c10a, ftLastAccessTime.dwLowDateTime=0x30e3c740, ftLastAccessTime.dwHighDateTime=0x1d5bd13, ftLastWriteTime.dwLowDateTime=0x30e3c740, ftLastWriteTime.dwHighDateTime=0x1d5bd13, nFileSizeHigh=0x0, nFileSizeLow=0x11fba, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Bct_Jx38ipMudu.png", cAlternateFileName="BCT_JX~1.PNG")) returned 0 [0253.016] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0253.016] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Bct_Jx38ipMudu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bct_jx38ipmudu.png")) returned 1 [0253.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Bct_Jx38ipMudu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bct_jx38ipmudu.png")) returned 0xffffffff [0253.017] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1dd2980, ftCreationTime.dwHighDateTime=0x1d5b747, ftLastAccessTime.dwLowDateTime=0xc571f020, ftLastAccessTime.dwHighDateTime=0x1d5b80a, ftLastWriteTime.dwLowDateTime=0xc571f020, ftLastWriteTime.dwHighDateTime=0x1d5b80a, nFileSizeHigh=0x0, nFileSizeLow=0x149fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="c7yefA5lIdO1x.gif", cAlternateFileName="C7YEFA~1.GIF")) returned 1 [0253.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0253.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0253.018] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0253.019] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0253.019] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.019] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e28) returned 0x10ab [0253.019] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0253.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c7yefA5lIdO1x.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\c7yefa5lido1x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0253.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\633779656641356C49644F3178.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\633779656641356c49644f3178.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.020] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x149fb [0253.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0253.020] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0253.109] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x149fb, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x149fb, lpOverlapped=0x0) returned 1 [0253.111] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14a00, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x14a00, lpOverlapped=0x0) returned 1 [0253.114] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.136] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.147] CloseHandle (hObject=0xf0) returned 1 [0253.147] CloseHandle (hObject=0xec) returned 1 [0253.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c7yefA5lIdO1x.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\c7yefa5lido1x.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\633779656641356C49644F3178.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\633779656641356c49644f3178.gif")) returned 0 [0253.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\633779656641356C49644F3178.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\633779656641356c49644f3178.gif")) returned 0x20 [0253.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c7yefA5lIdO1x.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1dd2980, ftCreationTime.dwHighDateTime=0x1d5b747, ftLastAccessTime.dwLowDateTime=0xc571f020, ftLastAccessTime.dwHighDateTime=0x1d5b80a, ftLastWriteTime.dwLowDateTime=0xc571f020, ftLastWriteTime.dwHighDateTime=0x1d5b80a, nFileSizeHigh=0x0, nFileSizeLow=0x149fb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="c7yefA5lIdO1x.gif", cAlternateFileName="C7YEFA~1.GIF")) returned 0x324f58 [0253.148] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1dd2980, ftCreationTime.dwHighDateTime=0x1d5b747, ftLastAccessTime.dwLowDateTime=0xc571f020, ftLastAccessTime.dwHighDateTime=0x1d5b80a, ftLastWriteTime.dwLowDateTime=0xc571f020, ftLastWriteTime.dwHighDateTime=0x1d5b80a, nFileSizeHigh=0x0, nFileSizeLow=0x149fb, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="c7yefA5lIdO1x.gif", cAlternateFileName="C7YEFA~1.GIF")) returned 0 [0253.148] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0253.148] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c7yefA5lIdO1x.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\c7yefa5lido1x.gif")) returned 1 [0253.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c7yefA5lIdO1x.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\c7yefa5lido1x.gif")) returned 0xffffffff [0253.150] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4623ddd0, ftCreationTime.dwHighDateTime=0x1d5bb6e, ftLastAccessTime.dwLowDateTime=0x531fed60, ftLastAccessTime.dwHighDateTime=0x1d5b747, ftLastWriteTime.dwLowDateTime=0x531fed60, ftLastWriteTime.dwHighDateTime=0x1d5b747, nFileSizeHigh=0x0, nFileSizeLow=0x5b49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cli2gG-yZRz6yUz.bmp", cAlternateFileName="CLI2GG~1.BMP")) returned 1 [0253.151] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0253.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0253.151] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0253.151] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0253.151] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.151] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d50) returned 0x10ab [0253.151] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0253.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Cli2gG-yZRz6yUz.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cli2gg-yzrz6yuz.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\436C693267472D795A527A3679557A.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\436c693267472d795a527a3679557a.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0253.153] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b49 [0253.153] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0253.153] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0253.241] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5b49, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x5b49, lpOverlapped=0x0) returned 1 [0253.242] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5b50, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x5b50, lpOverlapped=0x0) returned 1 [0253.243] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.265] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.276] CloseHandle (hObject=0xec) returned 1 [0253.276] CloseHandle (hObject=0xf0) returned 1 [0253.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Cli2gG-yZRz6yUz.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cli2gg-yzrz6yuz.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\436C693267472D795A527A3679557A.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\436c693267472d795a527a3679557a.bmp")) returned 0 [0253.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\436C693267472D795A527A3679557A.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\436c693267472d795a527a3679557a.bmp")) returned 0x20 [0253.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Cli2gG-yZRz6yUz.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4623ddd0, ftCreationTime.dwHighDateTime=0x1d5bb6e, ftLastAccessTime.dwLowDateTime=0x531fed60, ftLastAccessTime.dwHighDateTime=0x1d5b747, ftLastWriteTime.dwLowDateTime=0x531fed60, ftLastWriteTime.dwHighDateTime=0x1d5b747, nFileSizeHigh=0x0, nFileSizeLow=0x5b49, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Cli2gG-yZRz6yUz.bmp", cAlternateFileName="CLI2GG~1.BMP")) returned 0x324f58 [0253.278] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4623ddd0, ftCreationTime.dwHighDateTime=0x1d5bb6e, ftLastAccessTime.dwLowDateTime=0x531fed60, ftLastAccessTime.dwHighDateTime=0x1d5b747, ftLastWriteTime.dwLowDateTime=0x531fed60, ftLastWriteTime.dwHighDateTime=0x1d5b747, nFileSizeHigh=0x0, nFileSizeLow=0x5b49, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Cli2gG-yZRz6yUz.bmp", cAlternateFileName="CLI2GG~1.BMP")) returned 0 [0253.278] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0253.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Cli2gG-yZRz6yUz.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cli2gg-yzrz6yuz.bmp")) returned 1 [0253.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Cli2gG-yZRz6yUz.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cli2gg-yzrz6yuz.bmp")) returned 0xffffffff [0253.279] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22f3e30, ftCreationTime.dwHighDateTime=0x1d5bbfb, ftLastAccessTime.dwLowDateTime=0xfd0c52d0, ftLastAccessTime.dwHighDateTime=0x1d5b5e1, ftLastWriteTime.dwLowDateTime=0xfd0c52d0, ftLastWriteTime.dwHighDateTime=0x1d5b5e1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CzmGKArM5A.gif", cAlternateFileName="CZMGKA~1.GIF")) returned 1 [0253.280] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0253.280] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.280] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0253.280] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0253.281] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0253.281] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.281] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e28) returned 0x10ab [0253.281] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0253.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CzmGKArM5A.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czmgkarm5a.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0253.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\437A6D474B41724D3541.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\437a6d474b41724d3541.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.282] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10ae8 [0253.282] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0253.282] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0253.360] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10ae8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x10ae8, lpOverlapped=0x0) returned 1 [0253.362] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10af0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x10af0, lpOverlapped=0x0) returned 1 [0253.364] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.413] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.424] CloseHandle (hObject=0xf0) returned 1 [0253.424] CloseHandle (hObject=0xec) returned 1 [0253.424] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CzmGKArM5A.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czmgkarm5a.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\437A6D474B41724D3541.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\437a6d474b41724d3541.gif")) returned 0 [0253.425] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\437A6D474B41724D3541.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\437a6d474b41724d3541.gif")) returned 0x20 [0253.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CzmGKArM5A.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22f3e30, ftCreationTime.dwHighDateTime=0x1d5bbfb, ftLastAccessTime.dwLowDateTime=0xfd0c52d0, ftLastAccessTime.dwHighDateTime=0x1d5b5e1, ftLastWriteTime.dwLowDateTime=0xfd0c52d0, ftLastWriteTime.dwHighDateTime=0x1d5b5e1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CzmGKArM5A.gif", cAlternateFileName="CZMGKA~1.GIF")) returned 0x324f58 [0253.425] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22f3e30, ftCreationTime.dwHighDateTime=0x1d5bbfb, ftLastAccessTime.dwLowDateTime=0xfd0c52d0, ftLastAccessTime.dwHighDateTime=0x1d5b5e1, ftLastWriteTime.dwLowDateTime=0xfd0c52d0, ftLastWriteTime.dwHighDateTime=0x1d5b5e1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="CzmGKArM5A.gif", cAlternateFileName="CZMGKA~1.GIF")) returned 0 [0253.425] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0253.426] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CzmGKArM5A.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czmgkarm5a.gif")) returned 1 [0253.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CzmGKArM5A.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czmgkarm5a.gif")) returned 0xffffffff [0253.428] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0253.429] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0253.429] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.429] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0253.429] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0253.429] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d2c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0253.429] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.430] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d2c) returned 0x10ab [0253.430] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0253.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0253.431] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0253.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0253.431] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0253.505] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1f8, lpOverlapped=0x0) returned 1 [0253.505] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x200, lpOverlapped=0x0) returned 1 [0253.506] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.528] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.539] CloseHandle (hObject=0xec) returned 1 [0253.540] CloseHandle (hObject=0xf0) returned 1 [0253.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6465736b746f70.ini")) returned 0 [0253.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6465736b746f70.ini")) returned 0x20 [0253.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0253.541] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0253.541] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0253.541] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini")) returned 1 [0253.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini")) returned 0xffffffff [0253.542] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf42c0500, ftCreationTime.dwHighDateTime=0x1d5b8b3, ftLastAccessTime.dwLowDateTime=0x6db3bb40, ftLastAccessTime.dwHighDateTime=0x1d5c479, ftLastWriteTime.dwLowDateTime=0x6db3bb40, ftLastWriteTime.dwHighDateTime=0x1d5c479, nFileSizeHigh=0x0, nFileSizeLow=0xbc2b, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="ib7119orINUW2lSKZX.jpg", cAlternateFileName="IB7119~1.JPG")) returned 1 [0253.543] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0253.543] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.543] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0253.543] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0253.543] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0253.543] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.543] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d9c) returned 0x10ab [0253.543] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0253.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ib7119orINUW2lSKZX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ib7119orinuw2lskzx.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0253.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6962373131396F72494E5557326C534B5A58.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6962373131396f72494e5557326c534b5a58.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.544] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc2b [0253.544] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0253.545] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0253.653] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbc2b, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xbc2b, lpOverlapped=0x0) returned 1 [0253.654] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbc30, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xbc30, lpOverlapped=0x0) returned 1 [0253.656] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.678] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.688] CloseHandle (hObject=0xf0) returned 1 [0253.688] CloseHandle (hObject=0xec) returned 1 [0253.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ib7119orINUW2lSKZX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ib7119orinuw2lskzx.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6962373131396F72494E5557326C534B5A58.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6962373131396f72494e5557326c534b5a58.jpg")) returned 0 [0253.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6962373131396F72494E5557326C534B5A58.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6962373131396f72494e5557326c534b5a58.jpg")) returned 0x20 [0253.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ib7119orINUW2lSKZX.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf42c0500, ftCreationTime.dwHighDateTime=0x1d5b8b3, ftLastAccessTime.dwLowDateTime=0x6db3bb40, ftLastAccessTime.dwHighDateTime=0x1d5c479, ftLastWriteTime.dwLowDateTime=0x6db3bb40, ftLastWriteTime.dwHighDateTime=0x1d5c479, nFileSizeHigh=0x0, nFileSizeLow=0xbc2b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ib7119orINUW2lSKZX.jpg", cAlternateFileName="IB7119~1.JPG")) returned 0x324f58 [0253.689] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf42c0500, ftCreationTime.dwHighDateTime=0x1d5b8b3, ftLastAccessTime.dwLowDateTime=0x6db3bb40, ftLastAccessTime.dwHighDateTime=0x1d5c479, ftLastWriteTime.dwLowDateTime=0x6db3bb40, ftLastWriteTime.dwHighDateTime=0x1d5c479, nFileSizeHigh=0x0, nFileSizeLow=0xbc2b, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ib7119orINUW2lSKZX.jpg", cAlternateFileName="IB7119~1.JPG")) returned 0 [0253.689] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0253.690] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ib7119orINUW2lSKZX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ib7119orinuw2lskzx.jpg")) returned 1 [0253.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ib7119orINUW2lSKZX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ib7119orinuw2lskzx.jpg")) returned 0xffffffff [0253.691] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52afd40, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0xaf315e90, ftLastAccessTime.dwHighDateTime=0x1d5c007, ftLastWriteTime.dwLowDateTime=0xaf315e90, ftLastWriteTime.dwHighDateTime=0x1d5c007, nFileSizeHigh=0x0, nFileSizeLow=0x5555, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="JvjAhDI.png", cAlternateFileName="")) returned 1 [0253.692] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0253.692] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.692] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0253.692] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0253.692] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0253.692] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.692] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e7c) returned 0x10ab [0253.692] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0253.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\JvjAhDI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvjahdi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4A766A41684449.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4a766a41684449.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0253.693] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5555 [0253.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0253.694] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0253.779] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5555, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x5555, lpOverlapped=0x0) returned 1 [0253.780] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5560, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x5560, lpOverlapped=0x0) returned 1 [0253.789] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.811] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.821] CloseHandle (hObject=0xec) returned 1 [0253.821] CloseHandle (hObject=0xf0) returned 1 [0253.821] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\JvjAhDI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvjahdi.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4A766A41684449.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4a766a41684449.png")) returned 0 [0253.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4A766A41684449.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4a766a41684449.png")) returned 0x20 [0253.822] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\JvjAhDI.png", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52afd40, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0xaf315e90, ftLastAccessTime.dwHighDateTime=0x1d5c007, ftLastWriteTime.dwLowDateTime=0xaf315e90, ftLastWriteTime.dwHighDateTime=0x1d5c007, nFileSizeHigh=0x0, nFileSizeLow=0x5555, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="JvjAhDI.png", cAlternateFileName="")) returned 0x324f58 [0253.823] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52afd40, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0xaf315e90, ftLastAccessTime.dwHighDateTime=0x1d5c007, ftLastWriteTime.dwLowDateTime=0xaf315e90, ftLastWriteTime.dwHighDateTime=0x1d5c007, nFileSizeHigh=0x0, nFileSizeLow=0x5555, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="JvjAhDI.png", cAlternateFileName="")) returned 0 [0253.823] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0253.823] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\JvjAhDI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvjahdi.png")) returned 1 [0253.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\JvjAhDI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvjahdi.png")) returned 0xffffffff [0253.824] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c1d81f0, ftCreationTime.dwHighDateTime=0x1d5bfab, ftLastAccessTime.dwLowDateTime=0x6a02a490, ftLastAccessTime.dwHighDateTime=0x1d5b75c, ftLastWriteTime.dwLowDateTime=0x6a02a490, ftLastWriteTime.dwHighDateTime=0x1d5b75c, nFileSizeHigh=0x0, nFileSizeLow=0xeb3c, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="k4LdStwZUf2nTw6.gif", cAlternateFileName="K4LDST~1.GIF")) returned 1 [0253.825] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0253.825] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.825] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0253.825] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0253.825] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0253.825] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.825] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d28) returned 0x10ab [0253.825] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0253.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\k4LdStwZUf2nTw6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k4ldstwzuf2ntw6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0253.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6B344C645374775A5566326E547736.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6b344c645374775a5566326e547736.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.826] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb3c [0253.826] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0253.826] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0253.906] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xeb3c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xeb3c, lpOverlapped=0x0) returned 1 [0253.908] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xeb40, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xeb40, lpOverlapped=0x0) returned 1 [0253.925] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.947] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.958] CloseHandle (hObject=0xf0) returned 1 [0253.958] CloseHandle (hObject=0xec) returned 1 [0253.958] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\k4LdStwZUf2nTw6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k4ldstwzuf2ntw6.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6B344C645374775A5566326E547736.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6b344c645374775a5566326e547736.gif")) returned 0 [0253.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6B344C645374775A5566326E547736.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6b344c645374775a5566326e547736.gif")) returned 0x20 [0253.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\k4LdStwZUf2nTw6.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c1d81f0, ftCreationTime.dwHighDateTime=0x1d5bfab, ftLastAccessTime.dwLowDateTime=0x6a02a490, ftLastAccessTime.dwHighDateTime=0x1d5b75c, ftLastWriteTime.dwLowDateTime=0x6a02a490, ftLastWriteTime.dwHighDateTime=0x1d5b75c, nFileSizeHigh=0x0, nFileSizeLow=0xeb3c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="k4LdStwZUf2nTw6.gif", cAlternateFileName="K4LDST~1.GIF")) returned 0x324f58 [0253.959] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c1d81f0, ftCreationTime.dwHighDateTime=0x1d5bfab, ftLastAccessTime.dwLowDateTime=0x6a02a490, ftLastAccessTime.dwHighDateTime=0x1d5b75c, ftLastWriteTime.dwLowDateTime=0x6a02a490, ftLastWriteTime.dwHighDateTime=0x1d5b75c, nFileSizeHigh=0x0, nFileSizeLow=0xeb3c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="k4LdStwZUf2nTw6.gif", cAlternateFileName="K4LDST~1.GIF")) returned 0 [0253.959] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0253.959] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\k4LdStwZUf2nTw6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k4ldstwzuf2ntw6.gif")) returned 1 [0253.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\k4LdStwZUf2nTw6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k4ldstwzuf2ntw6.gif")) returned 0xffffffff [0253.961] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee97000, ftCreationTime.dwHighDateTime=0x1d5bc73, ftLastAccessTime.dwLowDateTime=0xce63cb10, ftLastAccessTime.dwHighDateTime=0x1d5bfb5, ftLastWriteTime.dwLowDateTime=0xce63cb10, ftLastWriteTime.dwHighDateTime=0x1d5bfb5, nFileSizeHigh=0x0, nFileSizeLow=0xd3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LPtT U69.gif", cAlternateFileName="LPTTU6~1.GIF")) returned 1 [0253.961] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0253.962] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.962] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0253.962] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0253.962] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0253.962] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0253.962] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e00) returned 0x10ab [0253.962] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0253.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LPtT U69.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lptt u69.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4C50745420553639.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4c50745420553639.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0253.963] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd3d8 [0253.963] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0253.963] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0254.034] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd3d8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xd3d8, lpOverlapped=0x0) returned 1 [0254.035] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd3e0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xd3e0, lpOverlapped=0x0) returned 1 [0254.037] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.059] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.069] CloseHandle (hObject=0xec) returned 1 [0254.069] CloseHandle (hObject=0xf0) returned 1 [0254.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LPtT U69.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lptt u69.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4C50745420553639.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4c50745420553639.gif")) returned 0 [0254.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4C50745420553639.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4c50745420553639.gif")) returned 0x20 [0254.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LPtT U69.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee97000, ftCreationTime.dwHighDateTime=0x1d5bc73, ftLastAccessTime.dwLowDateTime=0xce63cb10, ftLastAccessTime.dwHighDateTime=0x1d5bfb5, ftLastWriteTime.dwLowDateTime=0xce63cb10, ftLastWriteTime.dwHighDateTime=0x1d5bfb5, nFileSizeHigh=0x0, nFileSizeLow=0xd3d8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="LPtT U69.gif", cAlternateFileName="LPTTU6~1.GIF")) returned 0x324f58 [0254.070] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee97000, ftCreationTime.dwHighDateTime=0x1d5bc73, ftLastAccessTime.dwLowDateTime=0xce63cb10, ftLastAccessTime.dwHighDateTime=0x1d5bfb5, ftLastWriteTime.dwLowDateTime=0xce63cb10, ftLastWriteTime.dwHighDateTime=0x1d5bfb5, nFileSizeHigh=0x0, nFileSizeLow=0xd3d8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="LPtT U69.gif", cAlternateFileName="LPTTU6~1.GIF")) returned 0 [0254.070] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0254.071] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LPtT U69.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lptt u69.gif")) returned 1 [0254.072] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LPtT U69.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lptt u69.gif")) returned 0xffffffff [0254.072] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc64ac90, ftCreationTime.dwHighDateTime=0x1d5be3d, ftLastAccessTime.dwLowDateTime=0x299f4740, ftLastAccessTime.dwHighDateTime=0x1d5b762, ftLastWriteTime.dwLowDateTime=0x299f4740, ftLastWriteTime.dwHighDateTime=0x1d5b762, nFileSizeHigh=0x0, nFileSizeLow=0x106f6, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="MYEg0XWH.jpg", cAlternateFileName="")) returned 1 [0254.073] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0254.073] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.073] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0254.073] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0254.073] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d40, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0254.073] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.073] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d40) returned 0x10ab [0254.073] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0254.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MYEg0XWH.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\myeg0xwh.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0254.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4D59456730585748.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4d59456730585748.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.074] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106f6 [0254.074] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0254.074] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0254.159] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x106f6, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x106f6, lpOverlapped=0x0) returned 1 [0254.161] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10700, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x10700, lpOverlapped=0x0) returned 1 [0254.181] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.203] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.216] CloseHandle (hObject=0xf0) returned 1 [0254.216] CloseHandle (hObject=0xec) returned 1 [0254.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MYEg0XWH.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\myeg0xwh.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4D59456730585748.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4d59456730585748.jpg")) returned 0 [0254.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4D59456730585748.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4d59456730585748.jpg")) returned 0x20 [0254.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MYEg0XWH.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc64ac90, ftCreationTime.dwHighDateTime=0x1d5be3d, ftLastAccessTime.dwLowDateTime=0x299f4740, ftLastAccessTime.dwHighDateTime=0x1d5b762, ftLastWriteTime.dwLowDateTime=0x299f4740, ftLastWriteTime.dwHighDateTime=0x1d5b762, nFileSizeHigh=0x0, nFileSizeLow=0x106f6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MYEg0XWH.jpg", cAlternateFileName="")) returned 0x324f58 [0254.220] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc64ac90, ftCreationTime.dwHighDateTime=0x1d5be3d, ftLastAccessTime.dwLowDateTime=0x299f4740, ftLastAccessTime.dwHighDateTime=0x1d5b762, ftLastWriteTime.dwLowDateTime=0x299f4740, ftLastWriteTime.dwHighDateTime=0x1d5b762, nFileSizeHigh=0x0, nFileSizeLow=0x106f6, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MYEg0XWH.jpg", cAlternateFileName="")) returned 0 [0254.220] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0254.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MYEg0XWH.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\myeg0xwh.jpg")) returned 1 [0254.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MYEg0XWH.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\myeg0xwh.jpg")) returned 0xffffffff [0254.222] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b551f00, ftCreationTime.dwHighDateTime=0x1d5c4d3, ftLastAccessTime.dwLowDateTime=0xe0839390, ftLastAccessTime.dwHighDateTime=0x1d5be78, ftLastWriteTime.dwLowDateTime=0xe0839390, ftLastWriteTime.dwHighDateTime=0x1d5be78, nFileSizeHigh=0x0, nFileSizeLow=0x111ae, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="n0yb.bmp", cAlternateFileName="")) returned 1 [0254.225] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0254.225] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0254.228] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0254.228] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27db0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0254.228] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.228] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27db0) returned 0x10ab [0254.228] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0254.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\n0yb.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\n0yb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6E307962.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6e307962.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0254.229] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111ae [0254.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0254.230] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0254.317] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x111ae, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x111ae, lpOverlapped=0x0) returned 1 [0254.319] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x111b0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x111b0, lpOverlapped=0x0) returned 1 [0254.321] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.343] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.353] CloseHandle (hObject=0xec) returned 1 [0254.353] CloseHandle (hObject=0xf0) returned 1 [0254.354] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\n0yb.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\n0yb.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6E307962.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6e307962.bmp")) returned 0 [0254.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6E307962.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6e307962.bmp")) returned 0x20 [0254.355] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\n0yb.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b551f00, ftCreationTime.dwHighDateTime=0x1d5c4d3, ftLastAccessTime.dwLowDateTime=0xe0839390, ftLastAccessTime.dwHighDateTime=0x1d5be78, ftLastWriteTime.dwLowDateTime=0xe0839390, ftLastWriteTime.dwHighDateTime=0x1d5be78, nFileSizeHigh=0x0, nFileSizeLow=0x111ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="n0yb.bmp", cAlternateFileName="")) returned 0x324f58 [0254.355] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b551f00, ftCreationTime.dwHighDateTime=0x1d5c4d3, ftLastAccessTime.dwLowDateTime=0xe0839390, ftLastAccessTime.dwHighDateTime=0x1d5be78, ftLastWriteTime.dwLowDateTime=0xe0839390, ftLastWriteTime.dwHighDateTime=0x1d5be78, nFileSizeHigh=0x0, nFileSizeLow=0x111ae, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="n0yb.bmp", cAlternateFileName="")) returned 0 [0254.355] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0254.355] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\n0yb.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\n0yb.bmp")) returned 1 [0254.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\n0yb.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\n0yb.bmp")) returned 0xffffffff [0254.356] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643c14c0, ftCreationTime.dwHighDateTime=0x1d5c340, ftLastAccessTime.dwLowDateTime=0x84c97d40, ftLastAccessTime.dwHighDateTime=0x1d5bab2, ftLastWriteTime.dwLowDateTime=0x84c97d40, ftLastWriteTime.dwHighDateTime=0x1d5bab2, nFileSizeHigh=0x0, nFileSizeLow=0x82ce, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="O8wp5.jpg", cAlternateFileName="")) returned 1 [0254.357] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0254.357] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.357] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0254.357] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0254.357] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d08, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0254.357] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.357] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d08) returned 0x10ab [0254.358] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0254.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O8wp5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o8wp5.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0254.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4F38777035.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4f38777035.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.359] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82ce [0254.359] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0254.359] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0254.440] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x82ce, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x82ce, lpOverlapped=0x0) returned 1 [0254.442] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x82d0, lpOverlapped=0x0) returned 1 [0254.449] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.473] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.484] CloseHandle (hObject=0xf0) returned 1 [0254.484] CloseHandle (hObject=0xec) returned 1 [0254.484] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O8wp5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o8wp5.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4F38777035.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4f38777035.jpg")) returned 0 [0254.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4F38777035.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4f38777035.jpg")) returned 0x20 [0254.485] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O8wp5.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643c14c0, ftCreationTime.dwHighDateTime=0x1d5c340, ftLastAccessTime.dwLowDateTime=0x84c97d40, ftLastAccessTime.dwHighDateTime=0x1d5bab2, ftLastWriteTime.dwLowDateTime=0x84c97d40, ftLastWriteTime.dwHighDateTime=0x1d5bab2, nFileSizeHigh=0x0, nFileSizeLow=0x82ce, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="O8wp5.jpg", cAlternateFileName="")) returned 0x324f58 [0254.485] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643c14c0, ftCreationTime.dwHighDateTime=0x1d5c340, ftLastAccessTime.dwLowDateTime=0x84c97d40, ftLastAccessTime.dwHighDateTime=0x1d5bab2, ftLastWriteTime.dwLowDateTime=0x84c97d40, ftLastWriteTime.dwHighDateTime=0x1d5bab2, nFileSizeHigh=0x0, nFileSizeLow=0x82ce, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="O8wp5.jpg", cAlternateFileName="")) returned 0 [0254.485] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0254.485] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O8wp5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o8wp5.jpg")) returned 1 [0254.486] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O8wp5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o8wp5.jpg")) returned 0xffffffff [0254.487] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5f536d0, ftCreationTime.dwHighDateTime=0x1d5c22a, ftLastAccessTime.dwLowDateTime=0x2ae38bb0, ftLastAccessTime.dwHighDateTime=0x1d5c587, ftLastWriteTime.dwLowDateTime=0x2ae38bb0, ftLastWriteTime.dwHighDateTime=0x1d5c587, nFileSizeHigh=0x0, nFileSizeLow=0x8047, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="OtOXPzw0f2GPm3N.bmp", cAlternateFileName="OTOXPZ~1.BMP")) returned 1 [0254.487] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0254.487] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.488] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0254.488] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0254.488] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d3c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0254.488] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.488] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d3c) returned 0x10ab [0254.488] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0254.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OtOXPzw0f2GPm3N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\otoxpzw0f2gpm3n.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4F744F58507A7730663247506D334E.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4f744f58507a7730663247506d334e.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0254.490] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8047 [0254.490] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0254.491] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0254.577] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8047, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x8047, lpOverlapped=0x0) returned 1 [0254.578] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8050, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x8050, lpOverlapped=0x0) returned 1 [0254.579] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.606] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.617] CloseHandle (hObject=0xec) returned 1 [0254.617] CloseHandle (hObject=0xf0) returned 1 [0254.617] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OtOXPzw0f2GPm3N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\otoxpzw0f2gpm3n.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4F744F58507A7730663247506D334E.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4f744f58507a7730663247506d334e.bmp")) returned 0 [0254.618] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4F744F58507A7730663247506D334E.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4f744f58507a7730663247506d334e.bmp")) returned 0x20 [0254.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OtOXPzw0f2GPm3N.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5f536d0, ftCreationTime.dwHighDateTime=0x1d5c22a, ftLastAccessTime.dwLowDateTime=0x2ae38bb0, ftLastAccessTime.dwHighDateTime=0x1d5c587, ftLastWriteTime.dwLowDateTime=0x2ae38bb0, ftLastWriteTime.dwHighDateTime=0x1d5c587, nFileSizeHigh=0x0, nFileSizeLow=0x8047, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="OtOXPzw0f2GPm3N.bmp", cAlternateFileName="OTOXPZ~1.BMP")) returned 0x324f58 [0254.618] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5f536d0, ftCreationTime.dwHighDateTime=0x1d5c22a, ftLastAccessTime.dwLowDateTime=0x2ae38bb0, ftLastAccessTime.dwHighDateTime=0x1d5c587, ftLastWriteTime.dwLowDateTime=0x2ae38bb0, ftLastWriteTime.dwHighDateTime=0x1d5c587, nFileSizeHigh=0x0, nFileSizeLow=0x8047, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="OtOXPzw0f2GPm3N.bmp", cAlternateFileName="OTOXPZ~1.BMP")) returned 0 [0254.618] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0254.618] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OtOXPzw0f2GPm3N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\otoxpzw0f2gpm3n.bmp")) returned 1 [0254.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OtOXPzw0f2GPm3N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\otoxpzw0f2gpm3n.bmp")) returned 0xffffffff [0254.620] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceae4810, ftCreationTime.dwHighDateTime=0x1d5c588, ftLastAccessTime.dwLowDateTime=0xf31a2f20, ftLastAccessTime.dwHighDateTime=0x1d5c06f, ftLastWriteTime.dwLowDateTime=0xf31a2f20, ftLastWriteTime.dwHighDateTime=0x1d5c06f, nFileSizeHigh=0x0, nFileSizeLow=0x40ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="PQvZem9 C0RrlgB_.jpg", cAlternateFileName="PQVZEM~1.JPG")) returned 1 [0254.621] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0254.621] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.621] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0254.621] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0254.621] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0254.621] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.621] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d44) returned 0x10ab [0254.621] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0254.622] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQvZem9 C0RrlgB_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqvzem9 c0rrlgb_.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0254.622] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5051765A656D3920433052726C67425F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5051765a656d3920433052726c67425f.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.623] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40ba [0254.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0254.623] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0254.709] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x40ba, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x40ba, lpOverlapped=0x0) returned 1 [0254.710] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x40c0, lpOverlapped=0x0) returned 1 [0254.711] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.733] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.744] CloseHandle (hObject=0xf0) returned 1 [0254.744] CloseHandle (hObject=0xec) returned 1 [0254.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQvZem9 C0RrlgB_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqvzem9 c0rrlgb_.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5051765A656D3920433052726C67425F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5051765a656d3920433052726c67425f.jpg")) returned 0 [0254.745] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5051765A656D3920433052726C67425F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5051765a656d3920433052726c67425f.jpg")) returned 0x20 [0254.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQvZem9 C0RrlgB_.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceae4810, ftCreationTime.dwHighDateTime=0x1d5c588, ftLastAccessTime.dwLowDateTime=0xf31a2f20, ftLastAccessTime.dwHighDateTime=0x1d5c06f, ftLastWriteTime.dwLowDateTime=0xf31a2f20, ftLastWriteTime.dwHighDateTime=0x1d5c06f, nFileSizeHigh=0x0, nFileSizeLow=0x40ba, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="PQvZem9 C0RrlgB_.jpg", cAlternateFileName="PQVZEM~1.JPG")) returned 0x324f58 [0254.745] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceae4810, ftCreationTime.dwHighDateTime=0x1d5c588, ftLastAccessTime.dwLowDateTime=0xf31a2f20, ftLastAccessTime.dwHighDateTime=0x1d5c06f, ftLastWriteTime.dwLowDateTime=0xf31a2f20, ftLastWriteTime.dwHighDateTime=0x1d5c06f, nFileSizeHigh=0x0, nFileSizeLow=0x40ba, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="PQvZem9 C0RrlgB_.jpg", cAlternateFileName="PQVZEM~1.JPG")) returned 0 [0254.745] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0254.745] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQvZem9 C0RrlgB_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqvzem9 c0rrlgb_.jpg")) returned 1 [0254.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQvZem9 C0RrlgB_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqvzem9 c0rrlgb_.jpg")) returned 0xffffffff [0254.747] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f57d60, ftCreationTime.dwHighDateTime=0x1d5bba9, ftLastAccessTime.dwLowDateTime=0x5a258eb0, ftLastAccessTime.dwHighDateTime=0x1d5c392, ftLastWriteTime.dwLowDateTime=0x5a258eb0, ftLastWriteTime.dwHighDateTime=0x1d5c392, nFileSizeHigh=0x0, nFileSizeLow=0x1569b, dwReserved0=0x0, dwReserved1=0x0, cFileName="qRqPMQQGIqZmhsNVx.png", cAlternateFileName="QRQPMQ~1.PNG")) returned 1 [0254.748] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0254.748] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.748] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0254.748] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0254.748] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0254.748] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.748] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc4) returned 0x10ab [0254.748] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0254.749] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qRqPMQQGIqZmhsNVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qrqpmqqgiqzmhsnvx.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.749] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\715271504D51514749715A6D68734E5678.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\715271504d51514749715a6d68734e5678.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0254.749] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1569b [0254.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0254.750] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0254.820] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1569b, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1569b, lpOverlapped=0x0) returned 1 [0254.823] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x156a0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x156a0, lpOverlapped=0x0) returned 1 [0254.825] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.847] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.858] CloseHandle (hObject=0xec) returned 1 [0254.858] CloseHandle (hObject=0xf0) returned 1 [0254.858] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qRqPMQQGIqZmhsNVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qrqpmqqgiqzmhsnvx.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\715271504D51514749715A6D68734E5678.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\715271504d51514749715a6d68734e5678.png")) returned 0 [0254.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\715271504D51514749715A6D68734E5678.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\715271504d51514749715a6d68734e5678.png")) returned 0x20 [0254.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qRqPMQQGIqZmhsNVx.png", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f57d60, ftCreationTime.dwHighDateTime=0x1d5bba9, ftLastAccessTime.dwLowDateTime=0x5a258eb0, ftLastAccessTime.dwHighDateTime=0x1d5c392, ftLastWriteTime.dwLowDateTime=0x5a258eb0, ftLastWriteTime.dwHighDateTime=0x1d5c392, nFileSizeHigh=0x0, nFileSizeLow=0x1569b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qRqPMQQGIqZmhsNVx.png", cAlternateFileName="QRQPMQ~1.PNG")) returned 0x324f58 [0254.859] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f57d60, ftCreationTime.dwHighDateTime=0x1d5bba9, ftLastAccessTime.dwLowDateTime=0x5a258eb0, ftLastAccessTime.dwHighDateTime=0x1d5c392, ftLastWriteTime.dwLowDateTime=0x5a258eb0, ftLastWriteTime.dwHighDateTime=0x1d5c392, nFileSizeHigh=0x0, nFileSizeLow=0x1569b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qRqPMQQGIqZmhsNVx.png", cAlternateFileName="QRQPMQ~1.PNG")) returned 0 [0254.859] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0254.859] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qRqPMQQGIqZmhsNVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qrqpmqqgiqzmhsnvx.png")) returned 1 [0254.861] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qRqPMQQGIqZmhsNVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qrqpmqqgiqzmhsnvx.png")) returned 0xffffffff [0254.861] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543cdb10, ftCreationTime.dwHighDateTime=0x1d5bba5, ftLastAccessTime.dwLowDateTime=0x8dd1c1a0, ftLastAccessTime.dwHighDateTime=0x1d5bf84, ftLastWriteTime.dwLowDateTime=0x8dd1c1a0, ftLastWriteTime.dwHighDateTime=0x1d5bf84, nFileSizeHigh=0x0, nFileSizeLow=0x10b78, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="RZpRVGvG_9zi1W50eEX.bmp", cAlternateFileName="RZPRVG~1.BMP")) returned 1 [0254.862] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0254.862] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.862] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0254.862] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0254.862] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0254.862] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0254.862] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e48) returned 0x10ab [0254.862] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0254.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RZpRVGvG_9zi1W50eEX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rzprvgvg_9zi1w50eex.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0254.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\525A7052564776475F397A6931573530654558.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\525a7052564776475f397a6931573530654558.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.864] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b78 [0254.864] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0254.864] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0254.959] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10b78, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x10b78, lpOverlapped=0x0) returned 1 [0254.961] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10b80, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x10b80, lpOverlapped=0x0) returned 1 [0254.963] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.985] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.996] CloseHandle (hObject=0xf0) returned 1 [0254.996] CloseHandle (hObject=0xec) returned 1 [0254.996] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RZpRVGvG_9zi1W50eEX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rzprvgvg_9zi1w50eex.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\525A7052564776475F397A6931573530654558.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\525a7052564776475f397a6931573530654558.bmp")) returned 0 [0254.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\525A7052564776475F397A6931573530654558.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\525a7052564776475f397a6931573530654558.bmp")) returned 0x20 [0254.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RZpRVGvG_9zi1W50eEX.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543cdb10, ftCreationTime.dwHighDateTime=0x1d5bba5, ftLastAccessTime.dwLowDateTime=0x8dd1c1a0, ftLastAccessTime.dwHighDateTime=0x1d5bf84, ftLastWriteTime.dwLowDateTime=0x8dd1c1a0, ftLastWriteTime.dwHighDateTime=0x1d5bf84, nFileSizeHigh=0x0, nFileSizeLow=0x10b78, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="RZpRVGvG_9zi1W50eEX.bmp", cAlternateFileName="RZPRVG~1.BMP")) returned 0x324f58 [0254.997] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543cdb10, ftCreationTime.dwHighDateTime=0x1d5bba5, ftLastAccessTime.dwLowDateTime=0x8dd1c1a0, ftLastAccessTime.dwHighDateTime=0x1d5bf84, ftLastWriteTime.dwLowDateTime=0x8dd1c1a0, ftLastWriteTime.dwHighDateTime=0x1d5bf84, nFileSizeHigh=0x0, nFileSizeLow=0x10b78, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="RZpRVGvG_9zi1W50eEX.bmp", cAlternateFileName="RZPRVG~1.BMP")) returned 0 [0254.997] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0254.997] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RZpRVGvG_9zi1W50eEX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rzprvgvg_9zi1w50eex.bmp")) returned 1 [0254.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RZpRVGvG_9zi1W50eEX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rzprvgvg_9zi1w50eex.bmp")) returned 0xffffffff [0254.999] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf93880, ftCreationTime.dwHighDateTime=0x1d5bdb0, ftLastAccessTime.dwLowDateTime=0x1807af70, ftLastAccessTime.dwHighDateTime=0x1d5bfcf, ftLastWriteTime.dwLowDateTime=0x1807af70, ftLastWriteTime.dwHighDateTime=0x1d5bfcf, nFileSizeHigh=0x0, nFileSizeLow=0x57de, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="sOnfvh4Peetii9eZ049.bmp", cAlternateFileName="SONFVH~1.BMP")) returned 1 [0255.000] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0255.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0255.000] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0255.000] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27da0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0255.000] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.000] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27da0) returned 0x10ab [0255.000] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0255.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sOnfvh4Peetii9eZ049.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sonfvh4peetii9ez049.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\734F6E6676683450656574696939655A303439.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\734f6e6676683450656574696939655a303439.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.001] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x57de [0255.001] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0255.002] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0255.086] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x57de, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x57de, lpOverlapped=0x0) returned 1 [0255.088] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x57e0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x57e0, lpOverlapped=0x0) returned 1 [0255.089] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.110] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.121] CloseHandle (hObject=0xec) returned 1 [0255.121] CloseHandle (hObject=0xf0) returned 1 [0255.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sOnfvh4Peetii9eZ049.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sonfvh4peetii9ez049.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\734F6E6676683450656574696939655A303439.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\734f6e6676683450656574696939655a303439.bmp")) returned 0 [0255.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\734F6E6676683450656574696939655A303439.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\734f6e6676683450656574696939655a303439.bmp")) returned 0x20 [0255.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sOnfvh4Peetii9eZ049.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf93880, ftCreationTime.dwHighDateTime=0x1d5bdb0, ftLastAccessTime.dwLowDateTime=0x1807af70, ftLastAccessTime.dwHighDateTime=0x1d5bfcf, ftLastWriteTime.dwLowDateTime=0x1807af70, ftLastWriteTime.dwHighDateTime=0x1d5bfcf, nFileSizeHigh=0x0, nFileSizeLow=0x57de, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sOnfvh4Peetii9eZ049.bmp", cAlternateFileName="SONFVH~1.BMP")) returned 0x324f58 [0255.122] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf93880, ftCreationTime.dwHighDateTime=0x1d5bdb0, ftLastAccessTime.dwLowDateTime=0x1807af70, ftLastAccessTime.dwHighDateTime=0x1d5bfcf, ftLastWriteTime.dwLowDateTime=0x1807af70, ftLastWriteTime.dwHighDateTime=0x1d5bfcf, nFileSizeHigh=0x0, nFileSizeLow=0x57de, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sOnfvh4Peetii9eZ049.bmp", cAlternateFileName="SONFVH~1.BMP")) returned 0 [0255.122] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0255.123] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sOnfvh4Peetii9eZ049.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sonfvh4peetii9ez049.bmp")) returned 1 [0255.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sOnfvh4Peetii9eZ049.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sonfvh4peetii9ez049.bmp")) returned 0xffffffff [0255.124] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29930, ftCreationTime.dwHighDateTime=0x1d5bad7, ftLastAccessTime.dwLowDateTime=0xa04a28a0, ftLastAccessTime.dwHighDateTime=0x1d5c3b1, ftLastWriteTime.dwLowDateTime=0xa04a28a0, ftLastWriteTime.dwHighDateTime=0x1d5c3b1, nFileSizeHigh=0x0, nFileSizeLow=0x8488, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Sq5kMoW8pbp4mA.gif", cAlternateFileName="SQ5KMO~1.GIF")) returned 1 [0255.125] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0255.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0255.125] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0255.125] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e28, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0255.125] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.125] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e28) returned 0x10ab [0255.125] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0255.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Sq5kMoW8pbp4mA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sq5kmow8pbp4ma.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5371356B4D6F5738706270346D41.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5371356b4d6f5738706270346d41.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.126] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8488 [0255.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0255.127] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0255.212] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8488, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x8488, lpOverlapped=0x0) returned 1 [0255.213] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x8490, lpOverlapped=0x0) returned 1 [0255.214] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.236] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.247] CloseHandle (hObject=0xf0) returned 1 [0255.247] CloseHandle (hObject=0xec) returned 1 [0255.247] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Sq5kMoW8pbp4mA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sq5kmow8pbp4ma.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5371356B4D6F5738706270346D41.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5371356b4d6f5738706270346d41.gif")) returned 0 [0255.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5371356B4D6F5738706270346D41.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5371356b4d6f5738706270346d41.gif")) returned 0x20 [0255.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Sq5kMoW8pbp4mA.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29930, ftCreationTime.dwHighDateTime=0x1d5bad7, ftLastAccessTime.dwLowDateTime=0xa04a28a0, ftLastAccessTime.dwHighDateTime=0x1d5c3b1, ftLastWriteTime.dwLowDateTime=0xa04a28a0, ftLastWriteTime.dwHighDateTime=0x1d5c3b1, nFileSizeHigh=0x0, nFileSizeLow=0x8488, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Sq5kMoW8pbp4mA.gif", cAlternateFileName="SQ5KMO~1.GIF")) returned 0x324f58 [0255.248] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29930, ftCreationTime.dwHighDateTime=0x1d5bad7, ftLastAccessTime.dwLowDateTime=0xa04a28a0, ftLastAccessTime.dwHighDateTime=0x1d5c3b1, ftLastWriteTime.dwLowDateTime=0xa04a28a0, ftLastWriteTime.dwHighDateTime=0x1d5c3b1, nFileSizeHigh=0x0, nFileSizeLow=0x8488, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="Sq5kMoW8pbp4mA.gif", cAlternateFileName="SQ5KMO~1.GIF")) returned 0 [0255.248] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0255.249] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Sq5kMoW8pbp4mA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sq5kmow8pbp4ma.gif")) returned 1 [0255.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Sq5kMoW8pbp4mA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sq5kmow8pbp4ma.gif")) returned 0xffffffff [0255.250] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e817c50, ftCreationTime.dwHighDateTime=0x1d5b6a1, ftLastAccessTime.dwLowDateTime=0xf61cc190, ftLastAccessTime.dwHighDateTime=0x1d5c2b0, ftLastWriteTime.dwLowDateTime=0xf61cc190, ftLastWriteTime.dwHighDateTime=0x1d5c2b0, nFileSizeHigh=0x0, nFileSizeLow=0x13bdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="taE1q8sNqoI.bmp", cAlternateFileName="TAE1Q8~1.BMP")) returned 1 [0255.251] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0255.251] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.251] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0255.251] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0255.251] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0255.251] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.251] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d0c) returned 0x10ab [0255.251] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0255.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\taE1q8sNqoI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tae1q8snqoi.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\746145317138734E716F49.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\746145317138734e716f49.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.253] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13bdf [0255.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0255.253] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0255.335] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13bdf, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x13bdf, lpOverlapped=0x0) returned 1 [0255.337] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x13be0, lpOverlapped=0x0) returned 1 [0255.339] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.361] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.372] CloseHandle (hObject=0xec) returned 1 [0255.372] CloseHandle (hObject=0xf0) returned 1 [0255.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\taE1q8sNqoI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tae1q8snqoi.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\746145317138734E716F49.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\746145317138734e716f49.bmp")) returned 0 [0255.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\746145317138734E716F49.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\746145317138734e716f49.bmp")) returned 0x20 [0255.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\taE1q8sNqoI.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e817c50, ftCreationTime.dwHighDateTime=0x1d5b6a1, ftLastAccessTime.dwLowDateTime=0xf61cc190, ftLastAccessTime.dwHighDateTime=0x1d5c2b0, ftLastWriteTime.dwLowDateTime=0xf61cc190, ftLastWriteTime.dwHighDateTime=0x1d5c2b0, nFileSizeHigh=0x0, nFileSizeLow=0x13bdf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="taE1q8sNqoI.bmp", cAlternateFileName="TAE1Q8~1.BMP")) returned 0x324f58 [0255.373] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e817c50, ftCreationTime.dwHighDateTime=0x1d5b6a1, ftLastAccessTime.dwLowDateTime=0xf61cc190, ftLastAccessTime.dwHighDateTime=0x1d5c2b0, ftLastWriteTime.dwLowDateTime=0xf61cc190, ftLastWriteTime.dwHighDateTime=0x1d5c2b0, nFileSizeHigh=0x0, nFileSizeLow=0x13bdf, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="taE1q8sNqoI.bmp", cAlternateFileName="TAE1Q8~1.BMP")) returned 0 [0255.373] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0255.373] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\taE1q8sNqoI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tae1q8snqoi.bmp")) returned 1 [0255.375] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\taE1q8sNqoI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tae1q8snqoi.bmp")) returned 0xffffffff [0255.375] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf89b54f0, ftCreationTime.dwHighDateTime=0x1d5bdb4, ftLastAccessTime.dwLowDateTime=0xcc7c1fa0, ftLastAccessTime.dwHighDateTime=0x1d5b970, ftLastWriteTime.dwLowDateTime=0xcc7c1fa0, ftLastWriteTime.dwHighDateTime=0x1d5b970, nFileSizeHigh=0x0, nFileSizeLow=0x1846e, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="tV3gU850Nx.bmp", cAlternateFileName="TV3GU8~1.BMP")) returned 1 [0255.376] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0255.376] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.376] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0255.376] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0255.376] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27db8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0255.376] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.376] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27db8) returned 0x10ab [0255.376] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0255.377] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tV3gU850Nx.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tv3gu850nx.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.377] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\74563367553835304E78.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\74563367553835304e78.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.378] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1846e [0255.378] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0255.378] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0255.476] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1846e, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1846e, lpOverlapped=0x0) returned 1 [0255.478] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18470, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x18470, lpOverlapped=0x0) returned 1 [0255.481] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.503] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.513] CloseHandle (hObject=0xf0) returned 1 [0255.513] CloseHandle (hObject=0xec) returned 1 [0255.514] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tV3gU850Nx.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tv3gu850nx.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\74563367553835304E78.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\74563367553835304e78.bmp")) returned 0 [0255.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\74563367553835304E78.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\74563367553835304e78.bmp")) returned 0x20 [0255.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tV3gU850Nx.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf89b54f0, ftCreationTime.dwHighDateTime=0x1d5bdb4, ftLastAccessTime.dwLowDateTime=0xcc7c1fa0, ftLastAccessTime.dwHighDateTime=0x1d5b970, ftLastWriteTime.dwLowDateTime=0xcc7c1fa0, ftLastWriteTime.dwHighDateTime=0x1d5b970, nFileSizeHigh=0x0, nFileSizeLow=0x1846e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="tV3gU850Nx.bmp", cAlternateFileName="TV3GU8~1.BMP")) returned 0x324f58 [0255.515] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf89b54f0, ftCreationTime.dwHighDateTime=0x1d5bdb4, ftLastAccessTime.dwLowDateTime=0xcc7c1fa0, ftLastAccessTime.dwHighDateTime=0x1d5b970, ftLastWriteTime.dwLowDateTime=0xcc7c1fa0, ftLastWriteTime.dwHighDateTime=0x1d5b970, nFileSizeHigh=0x0, nFileSizeLow=0x1846e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="tV3gU850Nx.bmp", cAlternateFileName="TV3GU8~1.BMP")) returned 0 [0255.515] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0255.515] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tV3gU850Nx.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tv3gu850nx.bmp")) returned 1 [0255.517] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tV3gU850Nx.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tv3gu850nx.bmp")) returned 0xffffffff [0255.517] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809ae6d0, ftCreationTime.dwHighDateTime=0x1d5b7d5, ftLastAccessTime.dwLowDateTime=0xe7059ef0, ftLastAccessTime.dwHighDateTime=0x1d5bfec, ftLastWriteTime.dwLowDateTime=0xe7059ef0, ftLastWriteTime.dwHighDateTime=0x1d5bfec, nFileSizeHigh=0x0, nFileSizeLow=0x8508, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="tYb8noZZ3fB9F.gif", cAlternateFileName="TYB8NO~1.GIF")) returned 1 [0255.517] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0255.517] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.517] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0255.517] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0255.518] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d40, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0255.518] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.518] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d40) returned 0x10ab [0255.518] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0255.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tYb8noZZ3fB9F.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tyb8nozz3fb9f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\745962386E6F5A5A3366423946.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\745962386e6f5a5a3366423946.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.519] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8508 [0255.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0255.519] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0255.634] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8508, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x8508, lpOverlapped=0x0) returned 1 [0255.636] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8510, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x8510, lpOverlapped=0x0) returned 1 [0255.637] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.659] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.669] CloseHandle (hObject=0xec) returned 1 [0255.669] CloseHandle (hObject=0xf0) returned 1 [0255.669] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tYb8noZZ3fB9F.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tyb8nozz3fb9f.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\745962386E6F5A5A3366423946.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\745962386e6f5a5a3366423946.gif")) returned 0 [0255.670] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\745962386E6F5A5A3366423946.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\745962386e6f5a5a3366423946.gif")) returned 0x20 [0255.670] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tYb8noZZ3fB9F.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809ae6d0, ftCreationTime.dwHighDateTime=0x1d5b7d5, ftLastAccessTime.dwLowDateTime=0xe7059ef0, ftLastAccessTime.dwHighDateTime=0x1d5bfec, ftLastWriteTime.dwLowDateTime=0xe7059ef0, ftLastWriteTime.dwHighDateTime=0x1d5bfec, nFileSizeHigh=0x0, nFileSizeLow=0x8508, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tYb8noZZ3fB9F.gif", cAlternateFileName="TYB8NO~1.GIF")) returned 0x324f58 [0255.671] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809ae6d0, ftCreationTime.dwHighDateTime=0x1d5b7d5, ftLastAccessTime.dwLowDateTime=0xe7059ef0, ftLastAccessTime.dwHighDateTime=0x1d5bfec, ftLastWriteTime.dwLowDateTime=0xe7059ef0, ftLastWriteTime.dwHighDateTime=0x1d5bfec, nFileSizeHigh=0x0, nFileSizeLow=0x8508, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tYb8noZZ3fB9F.gif", cAlternateFileName="TYB8NO~1.GIF")) returned 0 [0255.671] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0255.671] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tYb8noZZ3fB9F.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tyb8nozz3fb9f.gif")) returned 1 [0255.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tYb8noZZ3fB9F.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tyb8nozz3fb9f.gif")) returned 0xffffffff [0255.672] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02118b0, ftCreationTime.dwHighDateTime=0x1d5c3b7, ftLastAccessTime.dwLowDateTime=0x6884e810, ftLastAccessTime.dwHighDateTime=0x1d5c23a, ftLastWriteTime.dwLowDateTime=0x6884e810, ftLastWriteTime.dwHighDateTime=0x1d5c23a, nFileSizeHigh=0x0, nFileSizeLow=0x18318, dwReserved0=0x0, dwReserved1=0x0, cFileName="ukBJGFYcfp33dFHh0CD.gif", cAlternateFileName="UKBJGF~1.GIF")) returned 1 [0255.673] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0255.673] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.673] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0255.673] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0255.673] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0255.673] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.674] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc0) returned 0x10ab [0255.674] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0255.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ukBJGFYcfp33dFHh0CD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ukbjgfycfp33dfhh0cd.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\756B424A474659636670333364464868304344.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\756b424a474659636670333364464868304344.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.675] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18318 [0255.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0255.675] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0255.760] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18318, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x18318, lpOverlapped=0x0) returned 1 [0255.762] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18320, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x18320, lpOverlapped=0x0) returned 1 [0255.764] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.786] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.797] CloseHandle (hObject=0xf0) returned 1 [0255.797] CloseHandle (hObject=0xec) returned 1 [0255.797] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ukBJGFYcfp33dFHh0CD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ukbjgfycfp33dfhh0cd.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\756B424A474659636670333364464868304344.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\756b424a474659636670333364464868304344.gif")) returned 0 [0255.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\756B424A474659636670333364464868304344.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\756b424a474659636670333364464868304344.gif")) returned 0x20 [0255.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ukBJGFYcfp33dFHh0CD.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02118b0, ftCreationTime.dwHighDateTime=0x1d5c3b7, ftLastAccessTime.dwLowDateTime=0x6884e810, ftLastAccessTime.dwHighDateTime=0x1d5c23a, ftLastWriteTime.dwLowDateTime=0x6884e810, ftLastWriteTime.dwHighDateTime=0x1d5c23a, nFileSizeHigh=0x0, nFileSizeLow=0x18318, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ukBJGFYcfp33dFHh0CD.gif", cAlternateFileName="UKBJGF~1.GIF")) returned 0x324f58 [0255.798] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02118b0, ftCreationTime.dwHighDateTime=0x1d5c3b7, ftLastAccessTime.dwLowDateTime=0x6884e810, ftLastAccessTime.dwHighDateTime=0x1d5c23a, ftLastWriteTime.dwLowDateTime=0x6884e810, ftLastWriteTime.dwHighDateTime=0x1d5c23a, nFileSizeHigh=0x0, nFileSizeLow=0x18318, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ukBJGFYcfp33dFHh0CD.gif", cAlternateFileName="UKBJGF~1.GIF")) returned 0 [0255.798] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0255.798] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ukBJGFYcfp33dFHh0CD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ukbjgfycfp33dfhh0cd.gif")) returned 1 [0255.800] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ukBJGFYcfp33dFHh0CD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ukbjgfycfp33dfhh0cd.gif")) returned 0xffffffff [0255.800] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359e45f0, ftCreationTime.dwHighDateTime=0x1d5bbfe, ftLastAccessTime.dwLowDateTime=0xeda2c710, ftLastAccessTime.dwHighDateTime=0x1d5c40b, ftLastWriteTime.dwLowDateTime=0xeda2c710, ftLastWriteTime.dwHighDateTime=0x1d5c40b, nFileSizeHigh=0x0, nFileSizeLow=0x13125, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="uoH_48.bmp", cAlternateFileName="")) returned 1 [0255.800] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0255.800] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.800] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0255.800] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0255.801] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ea8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0255.801] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.801] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ea8) returned 0x10ab [0255.801] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0255.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uoH_48.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uoh_48.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\756F485F3438.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\756f485f3438.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.802] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13125 [0255.802] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0255.802] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0255.890] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x13125, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x13125, lpOverlapped=0x0) returned 1 [0255.892] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13130, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x13130, lpOverlapped=0x0) returned 1 [0255.894] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.925] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.936] CloseHandle (hObject=0xec) returned 1 [0255.936] CloseHandle (hObject=0xf0) returned 1 [0255.936] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uoH_48.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uoh_48.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\756F485F3438.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\756f485f3438.bmp")) returned 0 [0255.937] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\756F485F3438.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\756f485f3438.bmp")) returned 0x20 [0255.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uoH_48.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359e45f0, ftCreationTime.dwHighDateTime=0x1d5bbfe, ftLastAccessTime.dwLowDateTime=0xeda2c710, ftLastAccessTime.dwHighDateTime=0x1d5c40b, ftLastWriteTime.dwLowDateTime=0xeda2c710, ftLastWriteTime.dwHighDateTime=0x1d5c40b, nFileSizeHigh=0x0, nFileSizeLow=0x13125, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uoH_48.bmp", cAlternateFileName="")) returned 0x324f58 [0255.937] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359e45f0, ftCreationTime.dwHighDateTime=0x1d5bbfe, ftLastAccessTime.dwLowDateTime=0xeda2c710, ftLastAccessTime.dwHighDateTime=0x1d5c40b, ftLastWriteTime.dwLowDateTime=0xeda2c710, ftLastWriteTime.dwHighDateTime=0x1d5c40b, nFileSizeHigh=0x0, nFileSizeLow=0x13125, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uoH_48.bmp", cAlternateFileName="")) returned 0 [0255.937] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0255.937] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uoH_48.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uoh_48.bmp")) returned 1 [0255.939] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uoH_48.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uoh_48.bmp")) returned 0xffffffff [0255.939] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ae840, ftCreationTime.dwHighDateTime=0x1d5be34, ftLastAccessTime.dwLowDateTime=0xe60e9100, ftLastAccessTime.dwHighDateTime=0x1d5c45b, ftLastWriteTime.dwLowDateTime=0xe60e9100, ftLastWriteTime.dwHighDateTime=0x1d5c45b, nFileSizeHigh=0x0, nFileSizeLow=0x842a, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="uX4bMIs.bmp", cAlternateFileName="")) returned 1 [0255.940] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0255.940] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.940] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0255.940] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0255.941] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d38, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0255.941] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0255.941] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d38) returned 0x10ab [0255.941] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0255.941] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uX4bMIs.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ux4bmis.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.941] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\755834624D4973.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\755834624d4973.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.942] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x842a [0255.942] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0255.942] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0256.013] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x842a, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x842a, lpOverlapped=0x0) returned 1 [0256.014] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x8430, lpOverlapped=0x0) returned 1 [0256.015] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.037] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.048] CloseHandle (hObject=0xf0) returned 1 [0256.048] CloseHandle (hObject=0xec) returned 1 [0256.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uX4bMIs.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ux4bmis.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\755834624D4973.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\755834624d4973.bmp")) returned 0 [0256.049] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\755834624D4973.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\755834624d4973.bmp")) returned 0x20 [0256.049] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uX4bMIs.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ae840, ftCreationTime.dwHighDateTime=0x1d5be34, ftLastAccessTime.dwLowDateTime=0xe60e9100, ftLastAccessTime.dwHighDateTime=0x1d5c45b, ftLastWriteTime.dwLowDateTime=0xe60e9100, ftLastWriteTime.dwHighDateTime=0x1d5c45b, nFileSizeHigh=0x0, nFileSizeLow=0x842a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uX4bMIs.bmp", cAlternateFileName="")) returned 0x324f58 [0256.049] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ae840, ftCreationTime.dwHighDateTime=0x1d5be34, ftLastAccessTime.dwLowDateTime=0xe60e9100, ftLastAccessTime.dwHighDateTime=0x1d5c45b, ftLastWriteTime.dwLowDateTime=0xe60e9100, ftLastWriteTime.dwHighDateTime=0x1d5c45b, nFileSizeHigh=0x0, nFileSizeLow=0x842a, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="uX4bMIs.bmp", cAlternateFileName="")) returned 0 [0256.049] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0256.049] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uX4bMIs.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ux4bmis.bmp")) returned 1 [0256.050] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uX4bMIs.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ux4bmis.bmp")) returned 0xffffffff [0256.056] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a26e3d0, ftCreationTime.dwHighDateTime=0x1d5c1e2, ftLastAccessTime.dwLowDateTime=0x94812be0, ftLastAccessTime.dwHighDateTime=0x1d5bf06, ftLastWriteTime.dwLowDateTime=0x94812be0, ftLastWriteTime.dwHighDateTime=0x1d5bf06, nFileSizeHigh=0x0, nFileSizeLow=0x2c03, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="uyUyCYMsblyOcw.bmp", cAlternateFileName="UYUYCY~1.BMP")) returned 1 [0256.056] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0256.056] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.056] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0256.056] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0256.057] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0256.057] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.057] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d00) returned 0x10ab [0256.057] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0256.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uyUyCYMsblyOcw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uyuycymsblyocw.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7579557943594D73626C794F6377.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7579557943594d73626c794f6377.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.058] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c03 [0256.058] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0256.058] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0256.144] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c03, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x2c03, lpOverlapped=0x0) returned 1 [0256.145] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2c10, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x2c10, lpOverlapped=0x0) returned 1 [0256.146] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.168] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.178] CloseHandle (hObject=0xec) returned 1 [0256.178] CloseHandle (hObject=0xf0) returned 1 [0256.179] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uyUyCYMsblyOcw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uyuycymsblyocw.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7579557943594D73626C794F6377.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7579557943594d73626c794f6377.bmp")) returned 0 [0256.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7579557943594D73626C794F6377.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7579557943594d73626c794f6377.bmp")) returned 0x20 [0256.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uyUyCYMsblyOcw.bmp", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a26e3d0, ftCreationTime.dwHighDateTime=0x1d5c1e2, ftLastAccessTime.dwLowDateTime=0x94812be0, ftLastAccessTime.dwHighDateTime=0x1d5bf06, ftLastWriteTime.dwLowDateTime=0x94812be0, ftLastWriteTime.dwHighDateTime=0x1d5bf06, nFileSizeHigh=0x0, nFileSizeLow=0x2c03, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uyUyCYMsblyOcw.bmp", cAlternateFileName="UYUYCY~1.BMP")) returned 0x324f58 [0256.180] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a26e3d0, ftCreationTime.dwHighDateTime=0x1d5c1e2, ftLastAccessTime.dwLowDateTime=0x94812be0, ftLastAccessTime.dwHighDateTime=0x1d5bf06, ftLastWriteTime.dwLowDateTime=0x94812be0, ftLastWriteTime.dwHighDateTime=0x1d5bf06, nFileSizeHigh=0x0, nFileSizeLow=0x2c03, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="uyUyCYMsblyOcw.bmp", cAlternateFileName="UYUYCY~1.BMP")) returned 0 [0256.180] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0256.180] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uyUyCYMsblyOcw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uyuycymsblyocw.bmp")) returned 1 [0256.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uyUyCYMsblyOcw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uyuycymsblyocw.bmp")) returned 0xffffffff [0256.181] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e704c50, ftCreationTime.dwHighDateTime=0x1d5b829, ftLastAccessTime.dwLowDateTime=0x417f520, ftLastAccessTime.dwHighDateTime=0x1d5b849, ftLastWriteTime.dwLowDateTime=0x417f520, ftLastWriteTime.dwHighDateTime=0x1d5b849, nFileSizeHigh=0x0, nFileSizeLow=0x14af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XQbKram9QifBFWu8vxq.jpg", cAlternateFileName="XQBKRA~1.JPG")) returned 1 [0256.183] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0256.183] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.183] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0256.183] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0256.184] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d54, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0256.184] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.184] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d54) returned 0x10ab [0256.184] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0256.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XQbKram9QifBFWu8vxq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xqbkram9qifbfwu8vxq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5851624B72616D395169664246577538767871.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5851624b72616d395169664246577538767871.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.185] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14af1 [0256.185] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0256.186] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0256.271] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14af1, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x14af1, lpOverlapped=0x0) returned 1 [0256.274] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14b00, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x14b00, lpOverlapped=0x0) returned 1 [0256.276] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.297] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.308] CloseHandle (hObject=0xf0) returned 1 [0256.308] CloseHandle (hObject=0xec) returned 1 [0256.308] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XQbKram9QifBFWu8vxq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xqbkram9qifbfwu8vxq.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5851624B72616D395169664246577538767871.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5851624b72616d395169664246577538767871.jpg")) returned 0 [0256.309] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5851624B72616D395169664246577538767871.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5851624b72616d395169664246577538767871.jpg")) returned 0x20 [0256.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XQbKram9QifBFWu8vxq.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e704c50, ftCreationTime.dwHighDateTime=0x1d5b829, ftLastAccessTime.dwLowDateTime=0x417f520, ftLastAccessTime.dwHighDateTime=0x1d5b849, ftLastWriteTime.dwLowDateTime=0x417f520, ftLastWriteTime.dwHighDateTime=0x1d5b849, nFileSizeHigh=0x0, nFileSizeLow=0x14af1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="XQbKram9QifBFWu8vxq.jpg", cAlternateFileName="XQBKRA~1.JPG")) returned 0x324f58 [0256.309] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e704c50, ftCreationTime.dwHighDateTime=0x1d5b829, ftLastAccessTime.dwLowDateTime=0x417f520, ftLastAccessTime.dwHighDateTime=0x1d5b849, ftLastWriteTime.dwLowDateTime=0x417f520, ftLastWriteTime.dwHighDateTime=0x1d5b849, nFileSizeHigh=0x0, nFileSizeLow=0x14af1, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="XQbKram9QifBFWu8vxq.jpg", cAlternateFileName="XQBKRA~1.JPG")) returned 0 [0256.309] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0256.309] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XQbKram9QifBFWu8vxq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xqbkram9qifbfwu8vxq.jpg")) returned 1 [0256.311] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XQbKram9QifBFWu8vxq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xqbkram9qifbfwu8vxq.jpg")) returned 0xffffffff [0256.311] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacdfad20, ftCreationTime.dwHighDateTime=0x1d5b695, ftLastAccessTime.dwLowDateTime=0x5a5d7840, ftLastAccessTime.dwHighDateTime=0x1d5bce7, ftLastWriteTime.dwLowDateTime=0x5a5d7840, ftLastWriteTime.dwHighDateTime=0x1d5bce7, nFileSizeHigh=0x0, nFileSizeLow=0xfd99, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="XruybxNUeqX9sDXLEjy.jpg", cAlternateFileName="XRUYBX~1.JPG")) returned 1 [0256.312] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0256.312] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.312] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0256.312] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0256.312] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e20, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0256.312] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.313] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e20) returned 0x10ab [0256.313] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0256.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XruybxNUeqX9sDXLEjy.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xruybxnueqx9sdxlejy.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5872757962784E55657158397344584C456A79.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5872757962784e55657158397344584c456a79.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.314] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd99 [0256.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0256.314] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0256.410] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0xfd99, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xfd99, lpOverlapped=0x0) returned 1 [0256.412] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xfda0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xfda0, lpOverlapped=0x0) returned 1 [0256.414] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.435] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.446] CloseHandle (hObject=0xec) returned 1 [0256.446] CloseHandle (hObject=0xf0) returned 1 [0256.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XruybxNUeqX9sDXLEjy.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xruybxnueqx9sdxlejy.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5872757962784E55657158397344584C456A79.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5872757962784e55657158397344584c456a79.jpg")) returned 0 [0256.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5872757962784E55657158397344584C456A79.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5872757962784e55657158397344584c456a79.jpg")) returned 0x20 [0256.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XruybxNUeqX9sDXLEjy.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacdfad20, ftCreationTime.dwHighDateTime=0x1d5b695, ftLastAccessTime.dwLowDateTime=0x5a5d7840, ftLastAccessTime.dwHighDateTime=0x1d5bce7, ftLastWriteTime.dwLowDateTime=0x5a5d7840, ftLastWriteTime.dwHighDateTime=0x1d5bce7, nFileSizeHigh=0x0, nFileSizeLow=0xfd99, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="XruybxNUeqX9sDXLEjy.jpg", cAlternateFileName="XRUYBX~1.JPG")) returned 0x324f58 [0256.447] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacdfad20, ftCreationTime.dwHighDateTime=0x1d5b695, ftLastAccessTime.dwLowDateTime=0x5a5d7840, ftLastAccessTime.dwHighDateTime=0x1d5bce7, ftLastWriteTime.dwLowDateTime=0x5a5d7840, ftLastWriteTime.dwHighDateTime=0x1d5bce7, nFileSizeHigh=0x0, nFileSizeLow=0xfd99, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="XruybxNUeqX9sDXLEjy.jpg", cAlternateFileName="XRUYBX~1.JPG")) returned 0 [0256.447] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0256.447] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XruybxNUeqX9sDXLEjy.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xruybxnueqx9sdxlejy.jpg")) returned 1 [0256.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XruybxNUeqX9sDXLEjy.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xruybxnueqx9sdxlejy.jpg")) returned 0xffffffff [0256.449] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28b45540, ftCreationTime.dwHighDateTime=0x1d5c019, ftLastAccessTime.dwLowDateTime=0xb96bd00, ftLastAccessTime.dwHighDateTime=0x1d5be10, ftLastWriteTime.dwLowDateTime=0xb96bd00, ftLastWriteTime.dwHighDateTime=0x1d5be10, nFileSizeHigh=0x0, nFileSizeLow=0x15747, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="YDtdRiM.gif", cAlternateFileName="")) returned 1 [0256.450] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0256.450] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.450] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0256.450] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0256.450] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ea8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0256.450] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.450] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ea8) returned 0x10ab [0256.450] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0256.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YDtdRiM.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ydtdrim.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5944746452694D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5944746452694d.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.452] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15747 [0256.452] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0256.452] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0256.523] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x15747, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x15747, lpOverlapped=0x0) returned 1 [0256.525] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x15750, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x15750, lpOverlapped=0x0) returned 1 [0256.527] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.549] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.560] CloseHandle (hObject=0xf0) returned 1 [0256.560] CloseHandle (hObject=0xec) returned 1 [0256.560] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YDtdRiM.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ydtdrim.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5944746452694D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5944746452694d.gif")) returned 0 [0256.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5944746452694D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5944746452694d.gif")) returned 0x20 [0256.561] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YDtdRiM.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28b45540, ftCreationTime.dwHighDateTime=0x1d5c019, ftLastAccessTime.dwLowDateTime=0xb96bd00, ftLastAccessTime.dwHighDateTime=0x1d5be10, ftLastWriteTime.dwLowDateTime=0xb96bd00, ftLastWriteTime.dwHighDateTime=0x1d5be10, nFileSizeHigh=0x0, nFileSizeLow=0x15747, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="YDtdRiM.gif", cAlternateFileName="")) returned 0x324f58 [0256.561] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28b45540, ftCreationTime.dwHighDateTime=0x1d5c019, ftLastAccessTime.dwLowDateTime=0xb96bd00, ftLastAccessTime.dwHighDateTime=0x1d5be10, ftLastWriteTime.dwLowDateTime=0xb96bd00, ftLastWriteTime.dwHighDateTime=0x1d5be10, nFileSizeHigh=0x0, nFileSizeLow=0x15747, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="YDtdRiM.gif", cAlternateFileName="")) returned 0 [0256.561] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0256.561] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YDtdRiM.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ydtdrim.gif")) returned 1 [0256.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YDtdRiM.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ydtdrim.gif")) returned 0xffffffff [0256.563] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3759f00, ftCreationTime.dwHighDateTime=0x1d5b7ca, ftLastAccessTime.dwLowDateTime=0x9e876d0, ftLastAccessTime.dwHighDateTime=0x1d5c45d, ftLastWriteTime.dwLowDateTime=0x9e876d0, ftLastWriteTime.dwHighDateTime=0x1d5c45d, nFileSizeHigh=0x0, nFileSizeLow=0x3f83, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Yr_xbxGFFogXHfA.gif", cAlternateFileName="YR_XBX~1.GIF")) returned 1 [0256.564] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0256.564] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.564] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0256.564] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0256.564] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ce0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0256.564] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.564] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ce0) returned 0x10ab [0256.564] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0256.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Yr_xbxGFFogXHfA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yr_xbxgffogxhfa.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\59725F7862784746466F6758486641.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\59725f7862784746466f6758486641.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.565] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f83 [0256.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0256.566] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0256.651] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3f83, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x3f83, lpOverlapped=0x0) returned 1 [0256.652] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x3f90, lpOverlapped=0x0) returned 1 [0256.653] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.680] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.690] CloseHandle (hObject=0xec) returned 1 [0256.690] CloseHandle (hObject=0xf0) returned 1 [0256.694] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Yr_xbxGFFogXHfA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yr_xbxgffogxhfa.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\59725F7862784746466F6758486641.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\59725f7862784746466f6758486641.gif")) returned 0 [0256.695] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\59725F7862784746466F6758486641.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\59725f7862784746466f6758486641.gif")) returned 0x20 [0256.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Yr_xbxGFFogXHfA.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3759f00, ftCreationTime.dwHighDateTime=0x1d5b7ca, ftLastAccessTime.dwLowDateTime=0x9e876d0, ftLastAccessTime.dwHighDateTime=0x1d5c45d, ftLastWriteTime.dwLowDateTime=0x9e876d0, ftLastWriteTime.dwHighDateTime=0x1d5c45d, nFileSizeHigh=0x0, nFileSizeLow=0x3f83, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Yr_xbxGFFogXHfA.gif", cAlternateFileName="YR_XBX~1.GIF")) returned 0x324f58 [0256.695] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3759f00, ftCreationTime.dwHighDateTime=0x1d5b7ca, ftLastAccessTime.dwLowDateTime=0x9e876d0, ftLastAccessTime.dwHighDateTime=0x1d5c45d, ftLastWriteTime.dwLowDateTime=0x9e876d0, ftLastWriteTime.dwHighDateTime=0x1d5c45d, nFileSizeHigh=0x0, nFileSizeLow=0x3f83, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Yr_xbxGFFogXHfA.gif", cAlternateFileName="YR_XBX~1.GIF")) returned 0 [0256.695] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0256.695] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Yr_xbxGFFogXHfA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yr_xbxgffogxhfa.gif")) returned 1 [0256.696] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Yr_xbxGFFogXHfA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yr_xbxgffogxhfa.gif")) returned 0xffffffff [0256.696] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f06ae70, ftCreationTime.dwHighDateTime=0x1d5b7b1, ftLastAccessTime.dwLowDateTime=0xdd1124f0, ftLastAccessTime.dwHighDateTime=0x1d5b99d, ftLastWriteTime.dwLowDateTime=0xdd1124f0, ftLastWriteTime.dwHighDateTime=0x1d5b99d, nFileSizeHigh=0x0, nFileSizeLow=0xe87c, dwReserved0=0x0, dwReserved1=0x0, cFileName="z8xil.gif", cAlternateFileName="")) returned 1 [0256.697] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0256.697] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.697] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0256.697] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0256.698] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27da4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0256.698] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.698] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27da4) returned 0x10ab [0256.698] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0256.698] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\z8xil.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z8xil.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.698] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7A3878696C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7a3878696c.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.699] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe87c [0256.699] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0256.699] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0256.785] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe87c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0xe87c, lpOverlapped=0x0) returned 1 [0256.787] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe880, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0xe880, lpOverlapped=0x0) returned 1 [0256.788] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.810] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.821] CloseHandle (hObject=0xf0) returned 1 [0256.821] CloseHandle (hObject=0xec) returned 1 [0256.821] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\z8xil.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z8xil.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7A3878696C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7a3878696c.gif")) returned 0 [0256.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7A3878696C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7a3878696c.gif")) returned 0x20 [0256.822] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\z8xil.gif", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f06ae70, ftCreationTime.dwHighDateTime=0x1d5b7b1, ftLastAccessTime.dwLowDateTime=0xdd1124f0, ftLastAccessTime.dwHighDateTime=0x1d5b99d, ftLastWriteTime.dwLowDateTime=0xdd1124f0, ftLastWriteTime.dwHighDateTime=0x1d5b99d, nFileSizeHigh=0x0, nFileSizeLow=0xe87c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="z8xil.gif", cAlternateFileName="")) returned 0x324f58 [0256.822] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f06ae70, ftCreationTime.dwHighDateTime=0x1d5b7b1, ftLastAccessTime.dwLowDateTime=0xdd1124f0, ftLastAccessTime.dwHighDateTime=0x1d5b99d, ftLastWriteTime.dwLowDateTime=0xdd1124f0, ftLastWriteTime.dwHighDateTime=0x1d5b99d, nFileSizeHigh=0x0, nFileSizeLow=0xe87c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="z8xil.gif", cAlternateFileName="")) returned 0 [0256.822] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0256.822] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\z8xil.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z8xil.gif")) returned 1 [0256.823] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\z8xil.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z8xil.gif")) returned 0xffffffff [0256.823] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2436fea0, ftCreationTime.dwHighDateTime=0x1d5c186, ftLastAccessTime.dwLowDateTime=0xeb3cfa30, ftLastAccessTime.dwHighDateTime=0x1d5c3d5, ftLastWriteTime.dwLowDateTime=0xeb3cfa30, ftLastWriteTime.dwHighDateTime=0x1d5c3d5, nFileSizeHigh=0x0, nFileSizeLow=0x4c96, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Z8yGVfoNq.jpg", cAlternateFileName="Z8YGVF~1.JPG")) returned 1 [0256.824] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0256.824] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.824] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0256.824] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0256.824] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27cfc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0256.824] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.824] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27cfc) returned 0x10ab [0256.825] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0256.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Z8yGVfoNq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z8ygvfonq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5A38794756666F4E71.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5a38794756666f4e71.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.827] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c96 [0256.827] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0256.827] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0256.912] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x4c96, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x4c96, lpOverlapped=0x0) returned 1 [0256.913] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x4ca0, lpOverlapped=0x0) returned 1 [0256.914] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.946] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.957] CloseHandle (hObject=0xec) returned 1 [0256.957] CloseHandle (hObject=0xf0) returned 1 [0256.957] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Z8yGVfoNq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z8ygvfonq.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5A38794756666F4E71.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5a38794756666f4e71.jpg")) returned 0 [0256.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5A38794756666F4E71.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5a38794756666f4e71.jpg")) returned 0x20 [0256.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Z8yGVfoNq.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2436fea0, ftCreationTime.dwHighDateTime=0x1d5c186, ftLastAccessTime.dwLowDateTime=0xeb3cfa30, ftLastAccessTime.dwHighDateTime=0x1d5c3d5, ftLastWriteTime.dwLowDateTime=0xeb3cfa30, ftLastWriteTime.dwHighDateTime=0x1d5c3d5, nFileSizeHigh=0x0, nFileSizeLow=0x4c96, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Z8yGVfoNq.jpg", cAlternateFileName="Z8YGVF~1.JPG")) returned 0x324f58 [0256.958] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2436fea0, ftCreationTime.dwHighDateTime=0x1d5c186, ftLastAccessTime.dwLowDateTime=0xeb3cfa30, ftLastAccessTime.dwHighDateTime=0x1d5c3d5, ftLastWriteTime.dwLowDateTime=0xeb3cfa30, ftLastWriteTime.dwHighDateTime=0x1d5c3d5, nFileSizeHigh=0x0, nFileSizeLow=0x4c96, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="Z8yGVfoNq.jpg", cAlternateFileName="Z8YGVF~1.JPG")) returned 0 [0256.958] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0256.958] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Z8yGVfoNq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z8ygvfonq.jpg")) returned 1 [0256.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Z8yGVfoNq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z8ygvfonq.jpg")) returned 0xffffffff [0256.960] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f568c0, ftCreationTime.dwHighDateTime=0x1d5c11e, ftLastAccessTime.dwLowDateTime=0x7b155310, ftLastAccessTime.dwHighDateTime=0x1d5c5e7, ftLastWriteTime.dwLowDateTime=0x7b155310, ftLastWriteTime.dwHighDateTime=0x1d5c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x8af7, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_9wUpU7zS-xw3.jpg", cAlternateFileName="_9WUPU~1.JPG")) returned 1 [0256.960] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0256.960] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.960] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0256.961] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0256.961] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d78, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0256.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0256.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d78) returned 0x10ab [0256.961] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0256.961] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_9wUpU7zS-xw3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_9wupu7zs-xw3.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.961] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5F3977557055377A532D787733.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5f3977557055377a532d787733.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.962] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8af7 [0256.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0256.962] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0257.033] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8af7, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x8af7, lpOverlapped=0x0) returned 1 [0257.035] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8b00, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x8b00, lpOverlapped=0x0) returned 1 [0257.036] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.058] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.069] CloseHandle (hObject=0xf0) returned 1 [0257.069] CloseHandle (hObject=0xec) returned 1 [0257.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_9wUpU7zS-xw3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_9wupu7zs-xw3.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5F3977557055377A532D787733.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5f3977557055377a532d787733.jpg")) returned 0 [0257.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5F3977557055377A532D787733.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5f3977557055377a532d787733.jpg")) returned 0x20 [0257.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_9wUpU7zS-xw3.jpg", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f568c0, ftCreationTime.dwHighDateTime=0x1d5c11e, ftLastAccessTime.dwLowDateTime=0x7b155310, ftLastAccessTime.dwHighDateTime=0x1d5c5e7, ftLastWriteTime.dwLowDateTime=0x7b155310, ftLastWriteTime.dwHighDateTime=0x1d5c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x8af7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="_9wUpU7zS-xw3.jpg", cAlternateFileName="_9WUPU~1.JPG")) returned 0x324f58 [0257.070] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f568c0, ftCreationTime.dwHighDateTime=0x1d5c11e, ftLastAccessTime.dwLowDateTime=0x7b155310, ftLastAccessTime.dwHighDateTime=0x1d5c5e7, ftLastWriteTime.dwLowDateTime=0x7b155310, ftLastWriteTime.dwHighDateTime=0x1d5c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x8af7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="_9wUpU7zS-xw3.jpg", cAlternateFileName="_9WUPU~1.JPG")) returned 0 [0257.070] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0257.070] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_9wUpU7zS-xw3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_9wupu7zs-xw3.jpg")) returned 1 [0257.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_9wUpU7zS-xw3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_9wupu7zs-xw3.jpg")) returned 0xffffffff [0257.071] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f568c0, ftCreationTime.dwHighDateTime=0x1d5c11e, ftLastAccessTime.dwLowDateTime=0x7b155310, ftLastAccessTime.dwHighDateTime=0x1d5c5e7, ftLastWriteTime.dwLowDateTime=0x7b155310, ftLastWriteTime.dwHighDateTime=0x1d5c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x8af7, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_9wUpU7zS-xw3.jpg", cAlternateFileName="_9WUPU~1.JPG")) returned 0 [0257.071] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0257.072] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66696770, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0257.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f568c0, ftCreationTime.dwHighDateTime=0x1d5c11e, ftLastAccessTime.dwLowDateTime=0x7b155310, ftLastAccessTime.dwHighDateTime=0x1d5c5e7, ftLastWriteTime.dwLowDateTime=0x7b155310, ftLastWriteTime.dwHighDateTime=0x1d5c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x8af7, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_9wUpU7zS-xw3.jpg", cAlternateFileName="°³1")) returned 0xffffffff [0257.072] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66696770, cFileName="Recent", cAlternateFileName="")) returned 1 [0257.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f568c0, ftCreationTime.dwHighDateTime=0x1d5c11e, ftLastAccessTime.dwLowDateTime=0x7b155310, ftLastAccessTime.dwHighDateTime=0x1d5c5e7, ftLastWriteTime.dwLowDateTime=0x7b155310, ftLastWriteTime.dwHighDateTime=0x1d5c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x8af7, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="_9wUpU7zS-xw3.jpg", cAlternateFileName="°³1")) returned 0xffffffff [0257.072] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66696770, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0257.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0257.073] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.073] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0257.073] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.073] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.073] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.073] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.074] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27df4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.074] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.074] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27df4) returned 0x10ab [0257.074] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0257.075] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0257.075] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0257.075] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0257.161] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x11a, lpOverlapped=0x0) returned 1 [0257.162] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x120, lpOverlapped=0x0) returned 1 [0257.163] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.185] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.196] CloseHandle (hObject=0xec) returned 1 [0257.196] CloseHandle (hObject=0xf0) returned 1 [0257.196] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\6465736b746f70.ini")) returned 0 [0257.197] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\6465736b746f70.ini")) returned 0x20 [0257.197] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0257.197] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0257.197] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0257.197] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini")) returned 1 [0257.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini")) returned 0xffffffff [0257.198] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0257.198] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0257.198] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66696770, cFileName="Searches", cAlternateFileName="")) returned 1 [0257.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0257.198] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="..", cAlternateFileName="")) returned 1 [0257.198] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0257.199] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.199] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.199] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.199] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e68, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.199] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.200] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e68) returned 0x10ab [0257.200] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0257.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.201] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20c [0257.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0257.201] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0257.287] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x20c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x20c, lpOverlapped=0x0) returned 1 [0257.288] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x210, lpOverlapped=0x0) returned 1 [0257.289] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.311] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.322] CloseHandle (hObject=0xf0) returned 1 [0257.322] CloseHandle (hObject=0xec) returned 1 [0257.328] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\6465736b746f70.ini")) returned 0 [0257.330] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\6465736b746f70.ini")) returned 0x20 [0257.330] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0257.330] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0257.330] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0257.330] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini")) returned 1 [0257.331] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini")) returned 0xffffffff [0257.331] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0257.333] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.333] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.333] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.333] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.333] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d54, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.333] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.334] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d54) returned 0x10ab [0257.334] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.334] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0257.334] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.334] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.334] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.334] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.335] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27da4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.335] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.335] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27da4) returned 0x10ab [0257.335] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.335] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0257.335] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0257.335] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0257.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Indexed Locations.search-ms", cAlternateFileName="°³1")) returned 0xffffffff [0257.335] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0257.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Indexed Locations.search-ms", cAlternateFileName="°³1")) returned 0xffffffff [0257.336] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0257.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Indexed Locations.search-ms", cAlternateFileName="°³1")) returned 0xffffffff [0257.336] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f5cee90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f5cee90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 1 [0257.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f5cee90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f5cee90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0257.336] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f5cee90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f5cee90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="..", cAlternateFileName="")) returned 1 [0257.336] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55756980, ftCreationTime.dwHighDateTime=0x1d5ba91, ftLastAccessTime.dwLowDateTime=0x5e4b88f0, ftLastAccessTime.dwHighDateTime=0x1d5b721, ftLastWriteTime.dwLowDateTime=0x5e4b88f0, ftLastWriteTime.dwHighDateTime=0x1d5b721, nFileSizeHigh=0x0, nFileSizeLow=0x6b21, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="a0PVNGNRy.flv", cAlternateFileName="A0PVNG~1.FLV")) returned 1 [0257.336] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.336] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.336] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.336] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.337] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d54, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.337] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.337] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d54) returned 0x10ab [0257.337] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\a0PVNGNRy.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\a0pvngnry.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\613050564E474E5279.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\613050564e474e5279.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0257.338] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b21 [0257.338] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0257.339] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0257.432] ReadFile (in: hFile=0xec, lpBuffer=0x280000c, nNumberOfBytesToRead=0x6b21, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x6b21, lpOverlapped=0x0) returned 1 [0257.433] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6b30, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x6b30, lpOverlapped=0x0) returned 1 [0257.434] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.457] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.467] CloseHandle (hObject=0xec) returned 1 [0257.467] CloseHandle (hObject=0xf0) returned 1 [0257.467] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\a0PVNGNRy.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\a0pvngnry.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\613050564E474E5279.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\613050564e474e5279.flv")) returned 0 [0257.468] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\613050564E474E5279.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\613050564e474e5279.flv")) returned 0x20 [0257.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\a0PVNGNRy.flv", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55756980, ftCreationTime.dwHighDateTime=0x1d5ba91, ftLastAccessTime.dwLowDateTime=0x5e4b88f0, ftLastAccessTime.dwHighDateTime=0x1d5b721, ftLastWriteTime.dwLowDateTime=0x5e4b88f0, ftLastWriteTime.dwHighDateTime=0x1d5b721, nFileSizeHigh=0x0, nFileSizeLow=0x6b21, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="a0PVNGNRy.flv", cAlternateFileName="A0PVNG~1.FLV")) returned 0x324f58 [0257.468] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55756980, ftCreationTime.dwHighDateTime=0x1d5ba91, ftLastAccessTime.dwLowDateTime=0x5e4b88f0, ftLastAccessTime.dwHighDateTime=0x1d5b721, ftLastWriteTime.dwLowDateTime=0x5e4b88f0, ftLastWriteTime.dwHighDateTime=0x1d5b721, nFileSizeHigh=0x0, nFileSizeLow=0x6b21, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="a0PVNGNRy.flv", cAlternateFileName="A0PVNG~1.FLV")) returned 0 [0257.469] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0257.469] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\a0PVNGNRy.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\a0pvngnry.flv")) returned 1 [0257.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\a0PVNGNRy.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\a0pvngnry.flv")) returned 0xffffffff [0257.471] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0257.472] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.472] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.472] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.472] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.472] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27dc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.472] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.472] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27dc4) returned 0x10ab [0257.472] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0257.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6465736b746f70.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.474] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0257.474] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0257.474] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0257.563] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f508*=0x1f8, lpOverlapped=0x0) returned 1 [0257.564] WriteFile (in: hFile=0xec, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f508*=0x200, lpOverlapped=0x0) returned 1 [0257.565] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.588] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.616] CloseHandle (hObject=0xf0) returned 1 [0257.616] CloseHandle (hObject=0xec) returned 1 [0257.616] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6465736b746f70.ini")) returned 0 [0257.617] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6465736B746F70.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6465736b746f70.ini")) returned 0x20 [0257.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x324f58 [0257.617] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0257.618] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0257.618] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini")) returned 1 [0257.618] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini")) returned 0xffffffff [0257.618] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfead06d0, ftCreationTime.dwHighDateTime=0x1d5c350, ftLastAccessTime.dwLowDateTime=0x822b6150, ftLastAccessTime.dwHighDateTime=0x1d5ba87, ftLastWriteTime.dwLowDateTime=0x822b6150, ftLastWriteTime.dwHighDateTime=0x1d5ba87, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758aedb, cFileName="EXAA7", cAlternateFileName="")) returned 1 [0257.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfead06d0, ftCreationTime.dwHighDateTime=0x1d5c350, ftLastAccessTime.dwLowDateTime=0x822b6150, ftLastAccessTime.dwHighDateTime=0x1d5ba87, ftLastWriteTime.dwLowDateTime=0x822b6150, ftLastWriteTime.dwHighDateTime=0x1d5ba87, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620060, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0257.619] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfead06d0, ftCreationTime.dwHighDateTime=0x1d5c350, ftLastAccessTime.dwLowDateTime=0x822b6150, ftLastAccessTime.dwHighDateTime=0x1d5ba87, ftLastWriteTime.dwLowDateTime=0x822b6150, ftLastWriteTime.dwHighDateTime=0x1d5ba87, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620060, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0257.619] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c21ab20, ftCreationTime.dwHighDateTime=0x1d5b5e9, ftLastAccessTime.dwLowDateTime=0xbf9aa0b0, ftLastAccessTime.dwHighDateTime=0x1d5c07b, ftLastWriteTime.dwLowDateTime=0xbf9aa0b0, ftLastWriteTime.dwHighDateTime=0x1d5c07b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620060, dwReserved1=0x31c7b8, cFileName="B8WCF", cAlternateFileName="")) returned 1 [0257.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c21ab20, ftCreationTime.dwHighDateTime=0x1d5b5e9, ftLastAccessTime.dwLowDateTime=0xbf9aa0b0, ftLastAccessTime.dwHighDateTime=0x1d5c07b, ftLastWriteTime.dwLowDateTime=0xbf9aa0b0, ftLastWriteTime.dwHighDateTime=0x1d5c07b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0257.619] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c21ab20, ftCreationTime.dwHighDateTime=0x1d5b5e9, ftLastAccessTime.dwLowDateTime=0xbf9aa0b0, ftLastAccessTime.dwHighDateTime=0x1d5c07b, ftLastWriteTime.dwLowDateTime=0xbf9aa0b0, ftLastWriteTime.dwHighDateTime=0x1d5c07b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0257.619] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99994250, ftCreationTime.dwHighDateTime=0x1d5ba6c, ftLastAccessTime.dwLowDateTime=0x177c33a0, ftLastAccessTime.dwHighDateTime=0x1d5c385, ftLastWriteTime.dwLowDateTime=0x177c33a0, ftLastWriteTime.dwHighDateTime=0x1d5c385, nFileSizeHigh=0x0, nFileSizeLow=0x86d6, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="0Hl7q00yunR0.mp4", cAlternateFileName="0HL7Q0~1.MP4")) returned 1 [0257.620] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.620] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.620] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.620] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.620] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27d58, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.620] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.620] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27d58) returned 0x10ab [0257.620] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.621] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea433cd0, ftCreationTime.dwHighDateTime=0x1d5c415, ftLastAccessTime.dwLowDateTime=0x90b6fd50, ftLastAccessTime.dwHighDateTime=0x1d5bf2e, ftLastWriteTime.dwLowDateTime=0x90b6fd50, ftLastWriteTime.dwHighDateTime=0x1d5bf2e, nFileSizeHigh=0x0, nFileSizeLow=0x18b16, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="ATpq16lmy9w.flv", cAlternateFileName="ATPQ16~1.FLV")) returned 1 [0257.621] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.621] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.621] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.621] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.621] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27da8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.621] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.621] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27da8) returned 0x10ab [0257.622] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.622] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\ATpq16lmy9w.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\atpq16lmy9w.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0257.622] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\4154707131366C6D793977.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\4154707131366c6d793977.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0257.623] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18b16 [0257.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0257.623] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0257.694] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18b16, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x18b16, lpOverlapped=0x0) returned 1 [0257.697] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18b20, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x18b20, lpOverlapped=0x0) returned 1 [0257.699] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.721] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.731] CloseHandle (hObject=0xfc) returned 1 [0257.732] CloseHandle (hObject=0x10c) returned 1 [0257.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\ATpq16lmy9w.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\atpq16lmy9w.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\4154707131366C6D793977.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\4154707131366c6d793977.flv")) returned 0 [0257.733] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\4154707131366C6D793977.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\4154707131366c6d793977.flv")) returned 0x20 [0257.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\ATpq16lmy9w.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea433cd0, ftCreationTime.dwHighDateTime=0x1d5c415, ftLastAccessTime.dwLowDateTime=0x90b6fd50, ftLastAccessTime.dwHighDateTime=0x1d5bf2e, ftLastWriteTime.dwLowDateTime=0x90b6fd50, ftLastWriteTime.dwHighDateTime=0x1d5bf2e, nFileSizeHigh=0x0, nFileSizeLow=0x18b16, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ATpq16lmy9w.flv", cAlternateFileName="ATPQ16~1.FLV")) returned 0x324fd8 [0257.733] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea433cd0, ftCreationTime.dwHighDateTime=0x1d5c415, ftLastAccessTime.dwLowDateTime=0x90b6fd50, ftLastAccessTime.dwHighDateTime=0x1d5bf2e, ftLastWriteTime.dwLowDateTime=0x90b6fd50, ftLastWriteTime.dwHighDateTime=0x1d5bf2e, nFileSizeHigh=0x0, nFileSizeLow=0x18b16, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ATpq16lmy9w.flv", cAlternateFileName="ATPQ16~1.FLV")) returned 0 [0257.733] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0257.733] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\ATpq16lmy9w.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\atpq16lmy9w.flv")) returned 1 [0257.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\ATpq16lmy9w.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\atpq16lmy9w.flv")) returned 0xffffffff [0257.735] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab7578a0, ftCreationTime.dwHighDateTime=0x1d5b7af, ftLastAccessTime.dwLowDateTime=0x241c4000, ftLastAccessTime.dwHighDateTime=0x1d5bbba, ftLastWriteTime.dwLowDateTime=0x241c4000, ftLastWriteTime.dwHighDateTime=0x1d5bbba, nFileSizeHigh=0x0, nFileSizeLow=0x175bb, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="exPl_P BNV.mp4", cAlternateFileName="EXPL_P~1.MP4")) returned 1 [0257.735] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.735] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.736] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.736] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.736] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.736] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.736] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e8c) returned 0x10ab [0257.736] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.736] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e3e3a0, ftCreationTime.dwHighDateTime=0x1d5beea, ftLastAccessTime.dwLowDateTime=0x3d332bf0, ftLastAccessTime.dwHighDateTime=0x1d5c117, ftLastWriteTime.dwLowDateTime=0x3d332bf0, ftLastWriteTime.dwHighDateTime=0x1d5c117, nFileSizeHigh=0x0, nFileSizeLow=0x15d1e, dwReserved0=0x18ef70, dwReserved1=0x18ef8c, cFileName="fBKfNQxhfsWkzMs.swf", cAlternateFileName="FBKFNQ~1.SWF")) returned 1 [0257.737] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.737] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.737] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.737] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.737] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27e8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.737] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.737] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27e8c) returned 0x10ab [0257.737] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\fBKfNQxhfsWkzMs.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\fbkfnqxhfswkzms.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0257.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\66424B664E5178686673576B7A4D73.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\66424b664e5178686673576b7a4d73.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0257.738] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15d1e [0257.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0257.739] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0257.826] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x15d1e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x15d1e, lpOverlapped=0x0) returned 1 [0257.828] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x15d20, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x15d20, lpOverlapped=0x0) returned 1 [0257.830] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.852] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.863] CloseHandle (hObject=0x10c) returned 1 [0257.863] CloseHandle (hObject=0xfc) returned 1 [0257.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\fBKfNQxhfsWkzMs.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\fbkfnqxhfswkzms.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\66424B664E5178686673576B7A4D73.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\66424b664e5178686673576b7a4d73.swf")) returned 0 [0257.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\66424B664E5178686673576B7A4D73.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\66424b664e5178686673576b7a4d73.swf")) returned 0x20 [0257.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\fBKfNQxhfsWkzMs.swf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e3e3a0, ftCreationTime.dwHighDateTime=0x1d5beea, ftLastAccessTime.dwLowDateTime=0x3d332bf0, ftLastAccessTime.dwHighDateTime=0x1d5c117, ftLastWriteTime.dwLowDateTime=0x3d332bf0, ftLastWriteTime.dwHighDateTime=0x1d5c117, nFileSizeHigh=0x0, nFileSizeLow=0x15d1e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="fBKfNQxhfsWkzMs.swf", cAlternateFileName="FBKFNQ~1.SWF")) returned 0x324fd8 [0257.864] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e3e3a0, ftCreationTime.dwHighDateTime=0x1d5beea, ftLastAccessTime.dwLowDateTime=0x3d332bf0, ftLastAccessTime.dwHighDateTime=0x1d5c117, ftLastWriteTime.dwLowDateTime=0x3d332bf0, ftLastWriteTime.dwHighDateTime=0x1d5c117, nFileSizeHigh=0x0, nFileSizeLow=0x15d1e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="fBKfNQxhfsWkzMs.swf", cAlternateFileName="FBKFNQ~1.SWF")) returned 0 [0257.864] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0257.865] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\fBKfNQxhfsWkzMs.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\fbkfnqxhfswkzms.swf")) returned 1 [0257.866] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\fBKfNQxhfsWkzMs.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\fbkfnqxhfswkzms.swf")) returned 0xffffffff [0257.866] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9135100, ftCreationTime.dwHighDateTime=0x1d5c00c, ftLastAccessTime.dwLowDateTime=0xcca79660, ftLastAccessTime.dwHighDateTime=0x1d5b594, ftLastWriteTime.dwLowDateTime=0xcca79660, ftLastWriteTime.dwHighDateTime=0x1d5b594, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="Moiok07T2Jx", cAlternateFileName="MOIOK0~1")) returned 1 [0257.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9135100, ftCreationTime.dwHighDateTime=0x1d5c00c, ftLastAccessTime.dwLowDateTime=0xcca79660, ftLastAccessTime.dwHighDateTime=0x1d5b594, ftLastWriteTime.dwLowDateTime=0xcca79660, ftLastWriteTime.dwHighDateTime=0x1d5b594, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0257.866] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9135100, ftCreationTime.dwHighDateTime=0x1d5c00c, ftLastAccessTime.dwLowDateTime=0xcca79660, ftLastAccessTime.dwHighDateTime=0x1d5b594, ftLastWriteTime.dwLowDateTime=0xcca79660, ftLastWriteTime.dwHighDateTime=0x1d5b594, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0257.866] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8bec30, ftCreationTime.dwHighDateTime=0x1d5c057, ftLastAccessTime.dwLowDateTime=0xc8a60a00, ftLastAccessTime.dwHighDateTime=0x1d5c337, ftLastWriteTime.dwLowDateTime=0xc8a60a00, ftLastWriteTime.dwHighDateTime=0x1d5c337, nFileSizeHigh=0x0, nFileSizeLow=0xf141, dwReserved0=0x8a0088, dwReserved1=0x31c7b8, cFileName="DGInpAUkDN4Vg05-.mkv", cAlternateFileName="DGINPA~1.MKV")) returned 1 [0257.867] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0257.867] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.867] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0257.867] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0257.867] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f20, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0257.867] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0257.867] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f20) returned 0x10ab [0257.867] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0257.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DGInpAUkDN4Vg05-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\dginpaukdn4vg05-.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0257.868] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\4447496E7041556B444E34566730352D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\4447496e7041556b444e34566730352d.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0257.868] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf141 [0257.868] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0257.869] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0257.966] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf141, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xf141, lpOverlapped=0x0) returned 1 [0257.968] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf150, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xf150, lpOverlapped=0x0) returned 1 [0257.970] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.992] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.002] CloseHandle (hObject=0x10c) returned 1 [0258.002] CloseHandle (hObject=0xf4) returned 1 [0258.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DGInpAUkDN4Vg05-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\dginpaukdn4vg05-.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\4447496E7041556B444E34566730352D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\4447496e7041556b444e34566730352d.mkv")) returned 0 [0258.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\4447496E7041556B444E34566730352D.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\4447496e7041556b444e34566730352d.mkv")) returned 0x20 [0258.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DGInpAUkDN4Vg05-.mkv", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8bec30, ftCreationTime.dwHighDateTime=0x1d5c057, ftLastAccessTime.dwLowDateTime=0xc8a60a00, ftLastAccessTime.dwHighDateTime=0x1d5c337, ftLastWriteTime.dwLowDateTime=0xc8a60a00, ftLastWriteTime.dwHighDateTime=0x1d5c337, nFileSizeHigh=0x0, nFileSizeLow=0xf141, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="DGInpAUkDN4Vg05-.mkv", cAlternateFileName="DGINPA~1.MKV")) returned 0x325018 [0258.004] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8bec30, ftCreationTime.dwHighDateTime=0x1d5c057, ftLastAccessTime.dwLowDateTime=0xc8a60a00, ftLastAccessTime.dwHighDateTime=0x1d5c337, ftLastWriteTime.dwLowDateTime=0xc8a60a00, ftLastWriteTime.dwHighDateTime=0x1d5c337, nFileSizeHigh=0x0, nFileSizeLow=0xf141, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="DGInpAUkDN4Vg05-.mkv", cAlternateFileName="DGINPA~1.MKV")) returned 0 [0258.004] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0258.004] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DGInpAUkDN4Vg05-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\dginpaukdn4vg05-.mkv")) returned 1 [0258.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DGInpAUkDN4Vg05-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\dginpaukdn4vg05-.mkv")) returned 0xffffffff [0258.005] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da020a0, ftCreationTime.dwHighDateTime=0x1d5bb0d, ftLastAccessTime.dwLowDateTime=0x5613e250, ftLastAccessTime.dwHighDateTime=0x1d5c1b6, ftLastWriteTime.dwLowDateTime=0x5613e250, ftLastWriteTime.dwHighDateTime=0x1d5c1b6, nFileSizeHigh=0x0, nFileSizeLow=0xb42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DXr5NvZcAsQloxQc.flv", cAlternateFileName="DXR5NV~1.FLV")) returned 1 [0258.006] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.006] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.006] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.006] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.007] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.007] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.007] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0258.007] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DXr5NvZcAsQloxQc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\dxr5nvzcasqloxqc.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0258.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\445872354E765A634173516C6F785163.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\445872354e765a634173516c6f785163.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0258.008] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb42e [0258.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0258.008] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0258.095] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb42e, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xb42e, lpOverlapped=0x0) returned 1 [0258.097] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb430, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xb430, lpOverlapped=0x0) returned 1 [0258.098] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.120] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.131] CloseHandle (hObject=0xf4) returned 1 [0258.131] CloseHandle (hObject=0x10c) returned 1 [0258.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DXr5NvZcAsQloxQc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\dxr5nvzcasqloxqc.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\445872354E765A634173516C6F785163.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\445872354e765a634173516c6f785163.flv")) returned 0 [0258.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\445872354E765A634173516C6F785163.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\445872354e765a634173516c6f785163.flv")) returned 0x20 [0258.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DXr5NvZcAsQloxQc.flv", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da020a0, ftCreationTime.dwHighDateTime=0x1d5bb0d, ftLastAccessTime.dwLowDateTime=0x5613e250, ftLastAccessTime.dwHighDateTime=0x1d5c1b6, ftLastWriteTime.dwLowDateTime=0x5613e250, ftLastWriteTime.dwHighDateTime=0x1d5c1b6, nFileSizeHigh=0x0, nFileSizeLow=0xb42e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="DXr5NvZcAsQloxQc.flv", cAlternateFileName="DXR5NV~1.FLV")) returned 0x325018 [0258.133] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da020a0, ftCreationTime.dwHighDateTime=0x1d5bb0d, ftLastAccessTime.dwLowDateTime=0x5613e250, ftLastAccessTime.dwHighDateTime=0x1d5c1b6, ftLastWriteTime.dwLowDateTime=0x5613e250, ftLastWriteTime.dwHighDateTime=0x1d5c1b6, nFileSizeHigh=0x0, nFileSizeLow=0xb42e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="DXr5NvZcAsQloxQc.flv", cAlternateFileName="DXR5NV~1.FLV")) returned 0 [0258.133] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0258.133] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DXr5NvZcAsQloxQc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\dxr5nvzcasqloxqc.flv")) returned 1 [0258.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\Moiok07T2Jx\\DXr5NvZcAsQloxQc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\moiok07t2jx\\dxr5nvzcasqloxqc.flv")) returned 0xffffffff [0258.135] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1995aaa0, ftCreationTime.dwHighDateTime=0x1d5baba, ftLastAccessTime.dwLowDateTime=0xa8895910, ftLastAccessTime.dwHighDateTime=0x1d5c05e, ftLastWriteTime.dwLowDateTime=0xa8895910, ftLastWriteTime.dwHighDateTime=0x1d5c05e, nFileSizeHigh=0x0, nFileSizeLow=0x9942, dwReserved0=0x0, dwReserved1=0x0, cFileName="ebhjnO 88CkTAy0A.mp4", cAlternateFileName="EBHJNO~1.MP4")) returned 1 [0258.135] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.135] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.135] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.135] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.136] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.136] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f0c) returned 0x10ab [0258.136] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.136] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebe8c80, ftCreationTime.dwHighDateTime=0x1d5b679, ftLastAccessTime.dwLowDateTime=0xfea5cbf0, ftLastAccessTime.dwHighDateTime=0x1d5c0c0, ftLastWriteTime.dwLowDateTime=0xfea5cbf0, ftLastWriteTime.dwHighDateTime=0x1d5c0c0, nFileSizeHigh=0x0, nFileSizeLow=0xe3cc, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="ERPDuysrw.mp4", cAlternateFileName="ERPDUY~1.MP4")) returned 1 [0258.136] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.136] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.137] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.137] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.137] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.137] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.137] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f0c) returned 0x10ab [0258.137] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.137] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32251bd0, ftCreationTime.dwHighDateTime=0x1d5c561, ftLastAccessTime.dwLowDateTime=0xde333150, ftLastAccessTime.dwHighDateTime=0x1d5c1a1, ftLastWriteTime.dwLowDateTime=0xde333150, ftLastWriteTime.dwHighDateTime=0x1d5c1a1, nFileSizeHigh=0x0, nFileSizeLow=0x667b, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="pa1iL5.mp4", cAlternateFileName="")) returned 1 [0258.138] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.138] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.138] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.138] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.138] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f0c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.138] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.138] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f0c) returned 0x10ab [0258.138] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.138] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32251bd0, ftCreationTime.dwHighDateTime=0x1d5c561, ftLastAccessTime.dwLowDateTime=0xde333150, ftLastAccessTime.dwHighDateTime=0x1d5c1a1, ftLastWriteTime.dwLowDateTime=0xde333150, ftLastWriteTime.dwHighDateTime=0x1d5c1a1, nFileSizeHigh=0x0, nFileSizeLow=0x667b, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="pa1iL5.mp4", cAlternateFileName="")) returned 0 [0258.138] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0258.138] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd73aefd0, ftCreationTime.dwHighDateTime=0x1d5bbe0, ftLastAccessTime.dwLowDateTime=0xf61f16e0, ftLastAccessTime.dwHighDateTime=0x1d5c4f2, ftLastWriteTime.dwLowDateTime=0xf61f16e0, ftLastWriteTime.dwHighDateTime=0x1d5c4f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30793470, dwReserved1=0x706d2e41, cFileName="SCzp1EW HinPZZsgc", cAlternateFileName="SCZP1E~1")) returned 1 [0258.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd73aefd0, ftCreationTime.dwHighDateTime=0x1d5bbe0, ftLastAccessTime.dwLowDateTime=0xf61f16e0, ftLastAccessTime.dwHighDateTime=0x1d5c4f2, ftLastWriteTime.dwLowDateTime=0xf61f16e0, ftLastWriteTime.dwHighDateTime=0x1d5c4f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0258.138] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd73aefd0, ftCreationTime.dwHighDateTime=0x1d5bbe0, ftLastAccessTime.dwLowDateTime=0xf61f16e0, ftLastAccessTime.dwHighDateTime=0x1d5c4f2, ftLastWriteTime.dwLowDateTime=0xf61f16e0, ftLastWriteTime.dwHighDateTime=0x1d5c4f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0258.139] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e98c0d0, ftCreationTime.dwHighDateTime=0x1d5bf94, ftLastAccessTime.dwLowDateTime=0x1b83bff0, ftLastAccessTime.dwHighDateTime=0x1d5bb73, ftLastWriteTime.dwLowDateTime=0x1b83bff0, ftLastWriteTime.dwHighDateTime=0x1d5bb73, nFileSizeHigh=0x0, nFileSizeLow=0x9356, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="-zHvBQ5gTPOWQxFxNCm.mp4", cAlternateFileName="-ZHVBQ~1.MP4")) returned 1 [0258.139] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.139] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.139] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.139] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.139] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.139] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.139] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0258.139] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.140] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b26fb50, ftCreationTime.dwHighDateTime=0x1d5bcc3, ftLastAccessTime.dwLowDateTime=0x9d365e80, ftLastAccessTime.dwHighDateTime=0x1d5ba25, ftLastWriteTime.dwLowDateTime=0x9d365e80, ftLastWriteTime.dwHighDateTime=0x1d5ba25, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="d0cPEl", cAlternateFileName="")) returned 1 [0258.140] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b26fb50, ftCreationTime.dwHighDateTime=0x1d5bcc3, ftLastAccessTime.dwLowDateTime=0x9d365e80, ftLastAccessTime.dwHighDateTime=0x1d5ba25, ftLastWriteTime.dwLowDateTime=0x9d365e80, ftLastWriteTime.dwHighDateTime=0x1d5ba25, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName=".", cAlternateFileName="")) returned 0x325018 [0258.140] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b26fb50, ftCreationTime.dwHighDateTime=0x1d5bcc3, ftLastAccessTime.dwLowDateTime=0x9d365e80, ftLastAccessTime.dwHighDateTime=0x1d5ba25, ftLastWriteTime.dwLowDateTime=0x9d365e80, ftLastWriteTime.dwHighDateTime=0x1d5ba25, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="..", cAlternateFileName="")) returned 1 [0258.140] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e248c0, ftCreationTime.dwHighDateTime=0x1d5b6c8, ftLastAccessTime.dwLowDateTime=0x14da94e0, ftLastAccessTime.dwHighDateTime=0x1d5c581, ftLastWriteTime.dwLowDateTime=0x14da94e0, ftLastWriteTime.dwHighDateTime=0x1d5c581, nFileSizeHigh=0x0, nFileSizeLow=0x3444, dwReserved0=0x18ec0c, dwReserved1=0x18ec0c, cFileName="7s4pege4mQRn0v.mkv", cAlternateFileName="7S4PEG~1.MKV")) returned 1 [0258.140] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.140] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.140] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.140] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.141] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f8c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.141] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.141] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f8c) returned 0x10ab [0258.141] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.141] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.142] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\7s4pege4mQRn0v.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\7s4pege4mqrn0v.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0258.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\37733470656765346D51526E3076.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\37733470656765346d51526e3076.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0258.143] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3444 [0258.143] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0258.143] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0258.214] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3444, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x3444, lpOverlapped=0x0) returned 1 [0258.215] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3450, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x3450, lpOverlapped=0x0) returned 1 [0258.216] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.238] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.249] CloseHandle (hObject=0xf4) returned 1 [0258.249] CloseHandle (hObject=0x100) returned 1 [0258.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\7s4pege4mQRn0v.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\7s4pege4mqrn0v.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\37733470656765346D51526E3076.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\37733470656765346d51526e3076.mkv")) returned 0 [0258.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\37733470656765346D51526E3076.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\37733470656765346d51526e3076.mkv")) returned 0x20 [0258.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\7s4pege4mQRn0v.mkv", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e248c0, ftCreationTime.dwHighDateTime=0x1d5b6c8, ftLastAccessTime.dwLowDateTime=0x14da94e0, ftLastAccessTime.dwHighDateTime=0x1d5c581, ftLastWriteTime.dwLowDateTime=0x14da94e0, ftLastWriteTime.dwHighDateTime=0x1d5c581, nFileSizeHigh=0x0, nFileSizeLow=0x3444, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7s4pege4mQRn0v.mkv", cAlternateFileName="7S4PEG~1.MKV")) returned 0x325058 [0258.251] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e248c0, ftCreationTime.dwHighDateTime=0x1d5b6c8, ftLastAccessTime.dwLowDateTime=0x14da94e0, ftLastAccessTime.dwHighDateTime=0x1d5c581, ftLastWriteTime.dwLowDateTime=0x14da94e0, ftLastWriteTime.dwHighDateTime=0x1d5c581, nFileSizeHigh=0x0, nFileSizeLow=0x3444, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="7s4pege4mQRn0v.mkv", cAlternateFileName="7S4PEG~1.MKV")) returned 0 [0258.251] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0258.251] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\7s4pege4mQRn0v.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\7s4pege4mqrn0v.mkv")) returned 1 [0258.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\7s4pege4mQRn0v.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\7s4pege4mqrn0v.mkv")) returned 0xffffffff [0258.252] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18c8100, ftCreationTime.dwHighDateTime=0x1d5ba1e, ftLastAccessTime.dwLowDateTime=0x99eaa590, ftLastAccessTime.dwHighDateTime=0x1d5b5a9, ftLastWriteTime.dwLowDateTime=0x99eaa590, ftLastWriteTime.dwHighDateTime=0x1d5b5a9, nFileSizeHigh=0x0, nFileSizeLow=0x18091, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="dkq6EIB031KH_GAc.avi", cAlternateFileName="DKQ6EI~1.AVI")) returned 1 [0258.253] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.253] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.253] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.253] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.254] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.254] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.254] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0258.254] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\dkq6EIB031KH_GAc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\dkq6eib031kh_gac.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0258.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\646B71364549423033314B485F474163.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\646b71364549423033314b485f474163.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0258.255] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18091 [0258.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0258.255] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0258.342] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18091, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18091, lpOverlapped=0x0) returned 1 [0258.345] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x180a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x180a0, lpOverlapped=0x0) returned 1 [0258.347] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.369] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.398] CloseHandle (hObject=0x100) returned 1 [0258.398] CloseHandle (hObject=0xf4) returned 1 [0258.399] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\dkq6EIB031KH_GAc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\dkq6eib031kh_gac.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\646B71364549423033314B485F474163.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\646b71364549423033314b485f474163.avi")) returned 0 [0258.400] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\646B71364549423033314B485F474163.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\646b71364549423033314b485f474163.avi")) returned 0x20 [0258.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\dkq6EIB031KH_GAc.avi", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18c8100, ftCreationTime.dwHighDateTime=0x1d5ba1e, ftLastAccessTime.dwLowDateTime=0x99eaa590, ftLastAccessTime.dwHighDateTime=0x1d5b5a9, ftLastWriteTime.dwLowDateTime=0x99eaa590, ftLastWriteTime.dwHighDateTime=0x1d5b5a9, nFileSizeHigh=0x0, nFileSizeLow=0x18091, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="dkq6EIB031KH_GAc.avi", cAlternateFileName="DKQ6EI~1.AVI")) returned 0x325058 [0258.400] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18c8100, ftCreationTime.dwHighDateTime=0x1d5ba1e, ftLastAccessTime.dwLowDateTime=0x99eaa590, ftLastAccessTime.dwHighDateTime=0x1d5b5a9, ftLastWriteTime.dwLowDateTime=0x99eaa590, ftLastWriteTime.dwHighDateTime=0x1d5b5a9, nFileSizeHigh=0x0, nFileSizeLow=0x18091, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="dkq6EIB031KH_GAc.avi", cAlternateFileName="DKQ6EI~1.AVI")) returned 0 [0258.400] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0258.400] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\dkq6EIB031KH_GAc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\dkq6eib031kh_gac.avi")) returned 1 [0258.401] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\dkq6EIB031KH_GAc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\dkq6eib031kh_gac.avi")) returned 0xffffffff [0258.401] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20876e70, ftCreationTime.dwHighDateTime=0x1d5c497, ftLastAccessTime.dwLowDateTime=0x30155200, ftLastAccessTime.dwHighDateTime=0x1d5c319, ftLastWriteTime.dwLowDateTime=0x30155200, ftLastWriteTime.dwHighDateTime=0x1d5c319, nFileSizeHigh=0x0, nFileSizeLow=0xf247, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="EedcEQ j_Jalmx7-H.mkv", cAlternateFileName="EEDCEQ~1.MKV")) returned 1 [0258.402] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.402] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.402] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.402] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.403] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.403] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.403] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0258.403] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\EedcEQ j_Jalmx7-H.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\eedceq j_jalmx7-h.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0258.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\456564634551206A5F4A616C6D78372D48.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\456564634551206a5f4a616c6d78372d48.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0258.404] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf247 [0258.404] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0258.405] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0258.480] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf247, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xf247, lpOverlapped=0x0) returned 1 [0258.482] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf250, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xf250, lpOverlapped=0x0) returned 1 [0258.486] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.508] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.519] CloseHandle (hObject=0xf4) returned 1 [0258.519] CloseHandle (hObject=0x100) returned 1 [0258.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\EedcEQ j_Jalmx7-H.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\eedceq j_jalmx7-h.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\456564634551206A5F4A616C6D78372D48.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\456564634551206a5f4a616c6d78372d48.mkv")) returned 0 [0258.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\456564634551206A5F4A616C6D78372D48.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\456564634551206a5f4a616c6d78372d48.mkv")) returned 0x20 [0258.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\EedcEQ j_Jalmx7-H.mkv", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20876e70, ftCreationTime.dwHighDateTime=0x1d5c497, ftLastAccessTime.dwLowDateTime=0x30155200, ftLastAccessTime.dwHighDateTime=0x1d5c319, ftLastWriteTime.dwLowDateTime=0x30155200, ftLastWriteTime.dwHighDateTime=0x1d5c319, nFileSizeHigh=0x0, nFileSizeLow=0xf247, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="EedcEQ j_Jalmx7-H.mkv", cAlternateFileName="EEDCEQ~1.MKV")) returned 0x325058 [0258.520] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20876e70, ftCreationTime.dwHighDateTime=0x1d5c497, ftLastAccessTime.dwLowDateTime=0x30155200, ftLastAccessTime.dwHighDateTime=0x1d5c319, ftLastWriteTime.dwLowDateTime=0x30155200, ftLastWriteTime.dwHighDateTime=0x1d5c319, nFileSizeHigh=0x0, nFileSizeLow=0xf247, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="EedcEQ j_Jalmx7-H.mkv", cAlternateFileName="EEDCEQ~1.MKV")) returned 0 [0258.520] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0258.520] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\EedcEQ j_Jalmx7-H.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\eedceq j_jalmx7-h.mkv")) returned 1 [0258.522] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\EedcEQ j_Jalmx7-H.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\eedceq j_jalmx7-h.mkv")) returned 0xffffffff [0258.522] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd31e2950, ftCreationTime.dwHighDateTime=0x1d5c07a, ftLastAccessTime.dwLowDateTime=0x7432d8e0, ftLastAccessTime.dwHighDateTime=0x1d5c5cb, ftLastWriteTime.dwLowDateTime=0x7432d8e0, ftLastWriteTime.dwHighDateTime=0x1d5c5cb, nFileSizeHigh=0x0, nFileSizeLow=0x8b86, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="HX8gnKUmqI.flv", cAlternateFileName="HX8GNK~1.FLV")) returned 1 [0258.523] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.523] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.523] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.523] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.523] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.523] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.523] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f7c) returned 0x10ab [0258.523] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\HX8gnKUmqI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\hx8gnkumqi.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0258.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\485838676E4B556D7149.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\485838676e4b556d7149.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0258.524] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b86 [0258.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0258.525] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0258.614] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8b86, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x8b86, lpOverlapped=0x0) returned 1 [0258.616] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x8b90, lpOverlapped=0x0) returned 1 [0258.618] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.640] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.651] CloseHandle (hObject=0x100) returned 1 [0258.651] CloseHandle (hObject=0xf4) returned 1 [0258.651] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\HX8gnKUmqI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\hx8gnkumqi.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\485838676E4B556D7149.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\485838676e4b556d7149.flv")) returned 0 [0258.652] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\485838676E4B556D7149.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\485838676e4b556d7149.flv")) returned 0x20 [0258.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\HX8gnKUmqI.flv", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd31e2950, ftCreationTime.dwHighDateTime=0x1d5c07a, ftLastAccessTime.dwLowDateTime=0x7432d8e0, ftLastAccessTime.dwHighDateTime=0x1d5c5cb, ftLastWriteTime.dwLowDateTime=0x7432d8e0, ftLastWriteTime.dwHighDateTime=0x1d5c5cb, nFileSizeHigh=0x0, nFileSizeLow=0x8b86, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="HX8gnKUmqI.flv", cAlternateFileName="HX8GNK~1.FLV")) returned 0x325058 [0258.652] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd31e2950, ftCreationTime.dwHighDateTime=0x1d5c07a, ftLastAccessTime.dwLowDateTime=0x7432d8e0, ftLastAccessTime.dwHighDateTime=0x1d5c5cb, ftLastWriteTime.dwLowDateTime=0x7432d8e0, ftLastWriteTime.dwHighDateTime=0x1d5c5cb, nFileSizeHigh=0x0, nFileSizeLow=0x8b86, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="HX8gnKUmqI.flv", cAlternateFileName="HX8GNK~1.FLV")) returned 0 [0258.652] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0258.652] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\HX8gnKUmqI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\hx8gnkumqi.flv")) returned 1 [0258.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\HX8gnKUmqI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\hx8gnkumqi.flv")) returned 0xffffffff [0258.654] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668c1380, ftCreationTime.dwHighDateTime=0x1d5c325, ftLastAccessTime.dwLowDateTime=0xe48b63d0, ftLastAccessTime.dwHighDateTime=0x1d5b920, ftLastWriteTime.dwLowDateTime=0xe48b63d0, ftLastWriteTime.dwHighDateTime=0x1d5b920, nFileSizeHigh=0x0, nFileSizeLow=0x18368, dwReserved0=0x0, dwReserved1=0x0, cFileName="jG8plG.swf", cAlternateFileName="")) returned 1 [0258.655] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.655] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.655] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.655] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.656] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.656] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.656] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0258.656] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\jG8plG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\jg8plg.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0258.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\6A4738706C47.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\6a4738706c47.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0258.658] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18368 [0258.658] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0258.658] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0258.743] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x18368, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x18368, lpOverlapped=0x0) returned 1 [0258.745] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x18370, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x18370, lpOverlapped=0x0) returned 1 [0258.747] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.769] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.780] CloseHandle (hObject=0xf4) returned 1 [0258.780] CloseHandle (hObject=0x100) returned 1 [0258.780] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\jG8plG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\jg8plg.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\6A4738706C47.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\6a4738706c47.swf")) returned 0 [0258.781] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\6A4738706C47.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\6a4738706c47.swf")) returned 0x20 [0258.781] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\jG8plG.swf", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668c1380, ftCreationTime.dwHighDateTime=0x1d5c325, ftLastAccessTime.dwLowDateTime=0xe48b63d0, ftLastAccessTime.dwHighDateTime=0x1d5b920, ftLastWriteTime.dwLowDateTime=0xe48b63d0, ftLastWriteTime.dwHighDateTime=0x1d5b920, nFileSizeHigh=0x0, nFileSizeLow=0x18368, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="jG8plG.swf", cAlternateFileName="")) returned 0x325058 [0258.781] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668c1380, ftCreationTime.dwHighDateTime=0x1d5c325, ftLastAccessTime.dwLowDateTime=0xe48b63d0, ftLastAccessTime.dwHighDateTime=0x1d5b920, ftLastWriteTime.dwLowDateTime=0xe48b63d0, ftLastWriteTime.dwHighDateTime=0x1d5b920, nFileSizeHigh=0x0, nFileSizeLow=0x18368, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="jG8plG.swf", cAlternateFileName="")) returned 0 [0258.781] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0258.781] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\jG8plG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\jg8plg.swf")) returned 1 [0258.782] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\jG8plG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\jg8plg.swf")) returned 0xffffffff [0258.783] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f79ce0, ftCreationTime.dwHighDateTime=0x1d5c0c9, ftLastAccessTime.dwLowDateTime=0xc92dd620, ftLastAccessTime.dwHighDateTime=0x1d5c480, ftLastWriteTime.dwLowDateTime=0xc92dd620, ftLastWriteTime.dwHighDateTime=0x1d5c480, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="o5_2ORo mnaFJ7QP", cAlternateFileName="O5_2OR~1")) returned 1 [0258.783] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f79ce0, ftCreationTime.dwHighDateTime=0x1d5c0c9, ftLastAccessTime.dwLowDateTime=0xc92dd620, ftLastAccessTime.dwHighDateTime=0x1d5c480, ftLastWriteTime.dwLowDateTime=0xc92dd620, ftLastWriteTime.dwHighDateTime=0x1d5c480, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x335f48, cFileName=".", cAlternateFileName="")) returned 0x325058 [0258.783] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f79ce0, ftCreationTime.dwHighDateTime=0x1d5c0c9, ftLastAccessTime.dwLowDateTime=0xc92dd620, ftLastAccessTime.dwHighDateTime=0x1d5c480, ftLastWriteTime.dwLowDateTime=0xc92dd620, ftLastWriteTime.dwHighDateTime=0x1d5c480, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x335f48, cFileName="..", cAlternateFileName="")) returned 1 [0258.783] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223e3e80, ftCreationTime.dwHighDateTime=0x1d5beaa, ftLastAccessTime.dwLowDateTime=0xf3278300, ftLastAccessTime.dwHighDateTime=0x1d5ba84, ftLastWriteTime.dwLowDateTime=0xf3278300, ftLastWriteTime.dwHighDateTime=0x1d5ba84, nFileSizeHigh=0x0, nFileSizeLow=0x836c, dwReserved0=0xaa00a8, dwReserved1=0x335f48, cFileName="-ToZ.flv", cAlternateFileName="")) returned 1 [0258.783] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.783] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.783] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.783] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.784] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.784] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.784] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0258.784] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.784] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\-ToZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\-toz.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0258.784] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\2D546F5A.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\2d546f5a.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0258.785] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x836c [0258.785] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0258.785] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0258.855] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x836c, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x836c, lpOverlapped=0x0) returned 1 [0258.856] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8370, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x8370, lpOverlapped=0x0) returned 1 [0258.873] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.895] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.905] CloseHandle (hObject=0xf4) returned 1 [0258.905] CloseHandle (hObject=0x104) returned 1 [0258.906] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\-ToZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\-toz.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\2D546F5A.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\2d546f5a.flv")) returned 0 [0258.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\2D546F5A.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\2d546f5a.flv")) returned 0x20 [0258.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\-ToZ.flv", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223e3e80, ftCreationTime.dwHighDateTime=0x1d5beaa, ftLastAccessTime.dwLowDateTime=0xf3278300, ftLastAccessTime.dwHighDateTime=0x1d5ba84, ftLastWriteTime.dwLowDateTime=0xf3278300, ftLastWriteTime.dwHighDateTime=0x1d5ba84, nFileSizeHigh=0x0, nFileSizeLow=0x836c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="-ToZ.flv", cAlternateFileName="")) returned 0x325098 [0258.906] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223e3e80, ftCreationTime.dwHighDateTime=0x1d5beaa, ftLastAccessTime.dwLowDateTime=0xf3278300, ftLastAccessTime.dwHighDateTime=0x1d5ba84, ftLastWriteTime.dwLowDateTime=0xf3278300, ftLastWriteTime.dwHighDateTime=0x1d5ba84, nFileSizeHigh=0x0, nFileSizeLow=0x836c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="-ToZ.flv", cAlternateFileName="")) returned 0 [0258.906] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0258.907] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\-ToZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\-toz.flv")) returned 1 [0258.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\-ToZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\-toz.flv")) returned 0xffffffff [0258.908] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14670250, ftCreationTime.dwHighDateTime=0x1d5bd0c, ftLastAccessTime.dwLowDateTime=0xcacdf1c0, ftLastAccessTime.dwHighDateTime=0x1d5b870, ftLastWriteTime.dwLowDateTime=0xcacdf1c0, ftLastWriteTime.dwHighDateTime=0x1d5b870, nFileSizeHigh=0x0, nFileSizeLow=0x176c5, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="584SS2MYXKH.avi", cAlternateFileName="584SS2~1.AVI")) returned 1 [0258.908] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0258.908] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.908] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0258.908] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0258.909] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0258.909] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0258.909] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0258.909] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0258.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\584SS2MYXKH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\584ss2myxkh.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0258.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\3538345353324D59584B48.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\3538345353324d59584b48.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0258.910] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176c5 [0258.910] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0258.910] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0258.989] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x176c5, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x176c5, lpOverlapped=0x0) returned 1 [0258.991] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x176d0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x176d0, lpOverlapped=0x0) returned 1 [0258.993] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.015] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.026] CloseHandle (hObject=0x104) returned 1 [0259.026] CloseHandle (hObject=0xf4) returned 1 [0259.026] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\584SS2MYXKH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\584ss2myxkh.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\3538345353324D59584B48.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\3538345353324d59584b48.avi")) returned 0 [0259.027] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\3538345353324D59584B48.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\3538345353324d59584b48.avi")) returned 0x20 [0259.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\584SS2MYXKH.avi", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14670250, ftCreationTime.dwHighDateTime=0x1d5bd0c, ftLastAccessTime.dwLowDateTime=0xcacdf1c0, ftLastAccessTime.dwHighDateTime=0x1d5b870, ftLastWriteTime.dwLowDateTime=0xcacdf1c0, ftLastWriteTime.dwHighDateTime=0x1d5b870, nFileSizeHigh=0x0, nFileSizeLow=0x176c5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="584SS2MYXKH.avi", cAlternateFileName="584SS2~1.AVI")) returned 0x325098 [0259.027] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14670250, ftCreationTime.dwHighDateTime=0x1d5bd0c, ftLastAccessTime.dwLowDateTime=0xcacdf1c0, ftLastAccessTime.dwHighDateTime=0x1d5b870, ftLastWriteTime.dwLowDateTime=0xcacdf1c0, ftLastWriteTime.dwHighDateTime=0x1d5b870, nFileSizeHigh=0x0, nFileSizeLow=0x176c5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="584SS2MYXKH.avi", cAlternateFileName="584SS2~1.AVI")) returned 0 [0259.027] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0259.027] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\584SS2MYXKH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\584ss2myxkh.avi")) returned 1 [0259.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\584SS2MYXKH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\584ss2myxkh.avi")) returned 0xffffffff [0259.028] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54927b00, ftCreationTime.dwHighDateTime=0x1d5bf5c, ftLastAccessTime.dwLowDateTime=0x1bf81dd0, ftLastAccessTime.dwHighDateTime=0x1d5b9cc, ftLastWriteTime.dwLowDateTime=0x1bf81dd0, ftLastWriteTime.dwHighDateTime=0x1d5b9cc, nFileSizeHigh=0x0, nFileSizeLow=0xcda, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="62rtwdm4p5a5WvYEYLt.swf", cAlternateFileName="62RTWD~1.SWF")) returned 1 [0259.029] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0259.029] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.029] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0259.029] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0259.029] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0259.029] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.029] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f7c) returned 0x10ab [0259.030] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0259.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\62rtwdm4p5a5WvYEYLt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\62rtwdm4p5a5wvyeylt.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0259.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\3632727477646D347035613557765945594C74.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\3632727477646d347035613557765945594c74.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0259.031] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcda [0259.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0259.031] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0259.115] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcda, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0xcda, lpOverlapped=0x0) returned 1 [0259.116] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0xce0, lpOverlapped=0x0) returned 1 [0259.117] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.138] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.149] CloseHandle (hObject=0xf4) returned 1 [0259.149] CloseHandle (hObject=0x104) returned 1 [0259.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\62rtwdm4p5a5WvYEYLt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\62rtwdm4p5a5wvyeylt.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\3632727477646D347035613557765945594C74.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\3632727477646d347035613557765945594c74.swf")) returned 0 [0259.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\3632727477646D347035613557765945594C74.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\3632727477646d347035613557765945594c74.swf")) returned 0x20 [0259.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\62rtwdm4p5a5WvYEYLt.swf", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54927b00, ftCreationTime.dwHighDateTime=0x1d5bf5c, ftLastAccessTime.dwLowDateTime=0x1bf81dd0, ftLastAccessTime.dwHighDateTime=0x1d5b9cc, ftLastWriteTime.dwLowDateTime=0x1bf81dd0, ftLastWriteTime.dwHighDateTime=0x1d5b9cc, nFileSizeHigh=0x0, nFileSizeLow=0xcda, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="62rtwdm4p5a5WvYEYLt.swf", cAlternateFileName="62RTWD~1.SWF")) returned 0x325098 [0259.150] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54927b00, ftCreationTime.dwHighDateTime=0x1d5bf5c, ftLastAccessTime.dwLowDateTime=0x1bf81dd0, ftLastAccessTime.dwHighDateTime=0x1d5b9cc, ftLastWriteTime.dwLowDateTime=0x1bf81dd0, ftLastWriteTime.dwHighDateTime=0x1d5b9cc, nFileSizeHigh=0x0, nFileSizeLow=0xcda, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="62rtwdm4p5a5WvYEYLt.swf", cAlternateFileName="62RTWD~1.SWF")) returned 0 [0259.150] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0259.150] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\62rtwdm4p5a5WvYEYLt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\62rtwdm4p5a5wvyeylt.swf")) returned 1 [0259.151] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\62rtwdm4p5a5WvYEYLt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\62rtwdm4p5a5wvyeylt.swf")) returned 0xffffffff [0259.151] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d351e0, ftCreationTime.dwHighDateTime=0x1d5c0b7, ftLastAccessTime.dwLowDateTime=0x5b3978e0, ftLastAccessTime.dwHighDateTime=0x1d5c354, ftLastWriteTime.dwLowDateTime=0x5b3978e0, ftLastWriteTime.dwHighDateTime=0x1d5c354, nFileSizeHigh=0x0, nFileSizeLow=0x57ff, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="w1Ie6bWSk-7Dj.avi", cAlternateFileName="W1IE6B~1.AVI")) returned 1 [0259.152] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0259.152] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0259.152] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0259.152] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27ff8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0259.152] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.152] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27ff8) returned 0x10ab [0259.152] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0259.152] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0259.153] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0259.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\w1Ie6bWSk-7Dj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\w1ie6bwsk-7dj.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0259.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\77314965366257536B2D37446A.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\77314965366257536b2d37446a.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0259.154] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x57ff [0259.154] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0259.154] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0259.239] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x57ff, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x57ff, lpOverlapped=0x0) returned 1 [0259.240] WriteFile (in: hFile=0xf4, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x5800, lpOverlapped=0x0) returned 1 [0259.241] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.263] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.281] CloseHandle (hObject=0x104) returned 1 [0259.281] CloseHandle (hObject=0xf4) returned 1 [0259.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\w1Ie6bWSk-7Dj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\w1ie6bwsk-7dj.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\77314965366257536B2D37446A.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\77314965366257536b2d37446a.avi")) returned 0 [0259.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\77314965366257536B2D37446A.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\77314965366257536b2d37446a.avi")) returned 0x20 [0259.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\w1Ie6bWSk-7Dj.avi", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d351e0, ftCreationTime.dwHighDateTime=0x1d5c0b7, ftLastAccessTime.dwLowDateTime=0x5b3978e0, ftLastAccessTime.dwHighDateTime=0x1d5c354, ftLastWriteTime.dwLowDateTime=0x5b3978e0, ftLastWriteTime.dwHighDateTime=0x1d5c354, nFileSizeHigh=0x0, nFileSizeLow=0x57ff, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="w1Ie6bWSk-7Dj.avi", cAlternateFileName="W1IE6B~1.AVI")) returned 0x325098 [0259.284] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d351e0, ftCreationTime.dwHighDateTime=0x1d5c0b7, ftLastAccessTime.dwLowDateTime=0x5b3978e0, ftLastAccessTime.dwHighDateTime=0x1d5c354, ftLastWriteTime.dwLowDateTime=0x5b3978e0, ftLastWriteTime.dwHighDateTime=0x1d5c354, nFileSizeHigh=0x0, nFileSizeLow=0x57ff, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="w1Ie6bWSk-7Dj.avi", cAlternateFileName="W1IE6B~1.AVI")) returned 0 [0259.284] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0259.284] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\w1Ie6bWSk-7Dj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\w1ie6bwsk-7dj.avi")) returned 1 [0259.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\w1Ie6bWSk-7Dj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\w1ie6bwsk-7dj.avi")) returned 0xffffffff [0259.285] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ab9560, ftCreationTime.dwHighDateTime=0x1d5c57c, ftLastAccessTime.dwLowDateTime=0x94329470, ftLastAccessTime.dwHighDateTime=0x1d5bfbb, ftLastWriteTime.dwLowDateTime=0x94329470, ftLastWriteTime.dwHighDateTime=0x1d5bfbb, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="WeLDi9-R18mefBa2Uluz.mkv", cAlternateFileName="WELDI9~1.MKV")) returned 1 [0259.286] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0259.286] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.286] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0259.286] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0259.287] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0259.287] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.287] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28008) returned 0x10ab [0259.287] VirtualFree (lpAddress=0x1c28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0259.287] VirtualAlloc (lpAddress=0x1c28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c28000 [0259.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\WeLDi9-R18mefBa2Uluz.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\weldi9-r18mefba2uluz.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0259.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\57654C4469392D5231386D6566426132556C757A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\57654c4469392d5231386d6566426132556c757a.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0259.289] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3dac [0259.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0259.289] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0259.366] ReadFile (in: hFile=0xf4, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3dac, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18e900*=0x3dac, lpOverlapped=0x0) returned 1 [0259.367] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18e900*=0x3db0, lpOverlapped=0x0) returned 1 [0259.369] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.422] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.432] CloseHandle (hObject=0xf4) returned 1 [0259.432] CloseHandle (hObject=0x104) returned 1 [0259.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\WeLDi9-R18mefBa2Uluz.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\weldi9-r18mefba2uluz.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\57654C4469392D5231386D6566426132556C757A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\57654c4469392d5231386d6566426132556c757a.mkv")) returned 0 [0259.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\57654C4469392D5231386D6566426132556C757A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\57654c4469392d5231386d6566426132556c757a.mkv")) returned 0x20 [0259.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\WeLDi9-R18mefBa2Uluz.mkv", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ab9560, ftCreationTime.dwHighDateTime=0x1d5c57c, ftLastAccessTime.dwLowDateTime=0x94329470, ftLastAccessTime.dwHighDateTime=0x1d5bfbb, ftLastWriteTime.dwLowDateTime=0x94329470, ftLastWriteTime.dwHighDateTime=0x1d5bfbb, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="WeLDi9-R18mefBa2Uluz.mkv", cAlternateFileName="WELDI9~1.MKV")) returned 0x325098 [0259.434] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ab9560, ftCreationTime.dwHighDateTime=0x1d5c57c, ftLastAccessTime.dwLowDateTime=0x94329470, ftLastAccessTime.dwHighDateTime=0x1d5bfbb, ftLastWriteTime.dwLowDateTime=0x94329470, ftLastWriteTime.dwHighDateTime=0x1d5bfbb, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="WeLDi9-R18mefBa2Uluz.mkv", cAlternateFileName="WELDI9~1.MKV")) returned 0 [0259.434] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0259.434] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\WeLDi9-R18mefBa2Uluz.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\weldi9-r18mefba2uluz.mkv")) returned 1 [0259.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\o5_2ORo mnaFJ7QP\\WeLDi9-R18mefBa2Uluz.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\o5_2oro mnafj7qp\\weldi9-r18mefba2uluz.mkv")) returned 0xffffffff [0259.436] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ab9560, ftCreationTime.dwHighDateTime=0x1d5c57c, ftLastAccessTime.dwLowDateTime=0x94329470, ftLastAccessTime.dwHighDateTime=0x1d5bfbb, ftLastWriteTime.dwLowDateTime=0x94329470, ftLastWriteTime.dwHighDateTime=0x1d5bfbb, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x7735387a, dwReserved1=0x7758b2c3, cFileName="WeLDi9-R18mefBa2Uluz.mkv", cAlternateFileName="WELDI9~1.MKV")) returned 0 [0259.436] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0259.436] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58494ee0, ftCreationTime.dwHighDateTime=0x1d5c335, ftLastAccessTime.dwLowDateTime=0x5bec2f10, ftLastAccessTime.dwHighDateTime=0x1d5be1a, ftLastWriteTime.dwLowDateTime=0x5bec2f10, ftLastWriteTime.dwHighDateTime=0x1d5be1a, nFileSizeHigh=0x0, nFileSizeLow=0x12d12, dwReserved0=0x61426665, dwReserved1=0x756c5532, cFileName="QBKXebfa_NU.swf", cAlternateFileName="QBKXEB~1.SWF")) returned 1 [0259.437] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0259.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0259.437] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28390, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0259.437] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.437] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28390) returned 0x10ab [0259.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\QBKXebfa_NU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\qbkxebfa_nu.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0259.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\51424B58656266615F4E55.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\51424b58656266615f4e55.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0259.438] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12d12 [0259.438] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0259.438] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0259.510] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x12d12, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x12d12, lpOverlapped=0x0) returned 1 [0259.512] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x12d20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x12d20, lpOverlapped=0x0) returned 1 [0259.515] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.537] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.548] CloseHandle (hObject=0x100) returned 1 [0259.548] CloseHandle (hObject=0x104) returned 1 [0259.548] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\QBKXebfa_NU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\qbkxebfa_nu.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\51424B58656266615F4E55.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\51424b58656266615f4e55.swf")) returned 0 [0259.549] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\51424B58656266615F4E55.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\51424b58656266615f4e55.swf")) returned 0x20 [0259.549] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\QBKXebfa_NU.swf", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58494ee0, ftCreationTime.dwHighDateTime=0x1d5c335, ftLastAccessTime.dwLowDateTime=0x5bec2f10, ftLastAccessTime.dwHighDateTime=0x1d5be1a, ftLastWriteTime.dwLowDateTime=0x5bec2f10, ftLastWriteTime.dwHighDateTime=0x1d5be1a, nFileSizeHigh=0x0, nFileSizeLow=0x12d12, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="QBKXebfa_NU.swf", cAlternateFileName="QBKXEB~1.SWF")) returned 0x325058 [0259.549] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58494ee0, ftCreationTime.dwHighDateTime=0x1d5c335, ftLastAccessTime.dwLowDateTime=0x5bec2f10, ftLastAccessTime.dwHighDateTime=0x1d5be1a, ftLastWriteTime.dwLowDateTime=0x5bec2f10, ftLastWriteTime.dwHighDateTime=0x1d5be1a, nFileSizeHigh=0x0, nFileSizeLow=0x12d12, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="QBKXebfa_NU.swf", cAlternateFileName="QBKXEB~1.SWF")) returned 0 [0259.549] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0259.549] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\QBKXebfa_NU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\qbkxebfa_nu.swf")) returned 1 [0259.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\QBKXebfa_NU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\qbkxebfa_nu.swf")) returned 0xffffffff [0259.550] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7a38d0, ftCreationTime.dwHighDateTime=0x1d5c076, ftLastAccessTime.dwLowDateTime=0x447a0aa0, ftLastAccessTime.dwHighDateTime=0x1d5bcbc, ftLastWriteTime.dwLowDateTime=0x447a0aa0, ftLastWriteTime.dwHighDateTime=0x1d5bcbc, nFileSizeHigh=0x0, nFileSizeLow=0xec59, dwReserved0=0x0, dwReserved1=0x0, cFileName="TyBijOqkZdepz7On6MwK.mkv", cAlternateFileName="TYBIJO~1.MKV")) returned 1 [0259.551] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0259.551] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.551] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0259.551] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28704, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0259.551] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.551] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28704) returned 0x10ab [0259.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\TyBijOqkZdepz7On6MwK.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\tybijoqkzdepz7on6mwk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0259.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\547942696A4F716B5A6465707A374F6E364D774B.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\547942696a4f716b5a6465707a374f6e364d774b.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0259.552] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec59 [0259.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0259.553] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0259.668] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xec59, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0xec59, lpOverlapped=0x0) returned 1 [0259.670] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xec60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0xec60, lpOverlapped=0x0) returned 1 [0259.672] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.694] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.705] CloseHandle (hObject=0x104) returned 1 [0259.705] CloseHandle (hObject=0x100) returned 1 [0259.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\TyBijOqkZdepz7On6MwK.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\tybijoqkzdepz7on6mwk.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\547942696A4F716B5A6465707A374F6E364D774B.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\547942696a4f716b5a6465707a374f6e364d774b.mkv")) returned 0 [0259.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\547942696A4F716B5A6465707A374F6E364D774B.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\547942696a4f716b5a6465707a374f6e364d774b.mkv")) returned 0x20 [0259.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\TyBijOqkZdepz7On6MwK.mkv", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7a38d0, ftCreationTime.dwHighDateTime=0x1d5c076, ftLastAccessTime.dwLowDateTime=0x447a0aa0, ftLastAccessTime.dwHighDateTime=0x1d5bcbc, ftLastWriteTime.dwLowDateTime=0x447a0aa0, ftLastWriteTime.dwHighDateTime=0x1d5bcbc, nFileSizeHigh=0x0, nFileSizeLow=0xec59, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="TyBijOqkZdepz7On6MwK.mkv", cAlternateFileName="TYBIJO~1.MKV")) returned 0x325058 [0259.706] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7a38d0, ftCreationTime.dwHighDateTime=0x1d5c076, ftLastAccessTime.dwLowDateTime=0x447a0aa0, ftLastAccessTime.dwHighDateTime=0x1d5bcbc, ftLastWriteTime.dwLowDateTime=0x447a0aa0, ftLastWriteTime.dwHighDateTime=0x1d5bcbc, nFileSizeHigh=0x0, nFileSizeLow=0xec59, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="TyBijOqkZdepz7On6MwK.mkv", cAlternateFileName="TYBIJO~1.MKV")) returned 0 [0259.706] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0259.706] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\TyBijOqkZdepz7On6MwK.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\tybijoqkzdepz7on6mwk.mkv")) returned 1 [0259.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\TyBijOqkZdepz7On6MwK.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\tybijoqkzdepz7on6mwk.mkv")) returned 0xffffffff [0259.708] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d869270, ftCreationTime.dwHighDateTime=0x1d5b96a, ftLastAccessTime.dwLowDateTime=0x4f213de0, ftLastAccessTime.dwHighDateTime=0x1d5c1ce, ftLastWriteTime.dwLowDateTime=0x4f213de0, ftLastWriteTime.dwHighDateTime=0x1d5c1ce, nFileSizeHigh=0x0, nFileSizeLow=0x8d33, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="_TeNED9Eml9.swf", cAlternateFileName="_TENED~1.SWF")) returned 1 [0259.709] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0259.709] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.709] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0259.709] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28b4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0259.709] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.709] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28b4c) returned 0x10ab [0259.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\_TeNED9Eml9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\_tened9eml9.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0259.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\5F54654E454439456D6C39.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\5f54654e454439456d6c39.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0259.710] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d33 [0259.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0259.710] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0259.797] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x8d33, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x8d33, lpOverlapped=0x0) returned 1 [0259.799] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x8d40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x8d40, lpOverlapped=0x0) returned 1 [0259.800] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.822] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.833] CloseHandle (hObject=0x100) returned 1 [0259.833] CloseHandle (hObject=0x104) returned 1 [0259.833] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\_TeNED9Eml9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\_tened9eml9.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\5F54654E454439456D6C39.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\5f54654e454439456d6c39.swf")) returned 0 [0259.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\5F54654E454439456D6C39.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\5f54654e454439456d6c39.swf")) returned 0x20 [0259.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\_TeNED9Eml9.swf", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d869270, ftCreationTime.dwHighDateTime=0x1d5b96a, ftLastAccessTime.dwLowDateTime=0x4f213de0, ftLastAccessTime.dwHighDateTime=0x1d5c1ce, ftLastWriteTime.dwLowDateTime=0x4f213de0, ftLastWriteTime.dwHighDateTime=0x1d5c1ce, nFileSizeHigh=0x0, nFileSizeLow=0x8d33, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_TeNED9Eml9.swf", cAlternateFileName="_TENED~1.SWF")) returned 0x325058 [0259.834] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d869270, ftCreationTime.dwHighDateTime=0x1d5b96a, ftLastAccessTime.dwLowDateTime=0x4f213de0, ftLastAccessTime.dwHighDateTime=0x1d5c1ce, ftLastWriteTime.dwLowDateTime=0x4f213de0, ftLastWriteTime.dwHighDateTime=0x1d5c1ce, nFileSizeHigh=0x0, nFileSizeLow=0x8d33, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_TeNED9Eml9.swf", cAlternateFileName="_TENED~1.SWF")) returned 0 [0259.834] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0259.834] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\_TeNED9Eml9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\_tened9eml9.swf")) returned 1 [0259.835] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\d0cPEl\\_TeNED9Eml9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\d0cpel\\_tened9eml9.swf")) returned 0xffffffff [0259.835] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d869270, ftCreationTime.dwHighDateTime=0x1d5b96a, ftLastAccessTime.dwLowDateTime=0x4f213de0, ftLastAccessTime.dwHighDateTime=0x1d5c1ce, ftLastWriteTime.dwLowDateTime=0x4f213de0, ftLastWriteTime.dwHighDateTime=0x1d5c1ce, nFileSizeHigh=0x0, nFileSizeLow=0x8d33, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="_TeNED9Eml9.swf", cAlternateFileName="_TENED~1.SWF")) returned 0 [0259.835] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0259.836] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5766c8a0, ftCreationTime.dwHighDateTime=0x1d5c2e9, ftLastAccessTime.dwLowDateTime=0x5e4e7550, ftLastAccessTime.dwHighDateTime=0x1d5c5aa, ftLastWriteTime.dwLowDateTime=0x5e4e7550, ftLastWriteTime.dwHighDateTime=0x1d5c5aa, nFileSizeHigh=0x0, nFileSizeLow=0x5e82, dwReserved0=0x6677732e, dwReserved1=0x774d366e, cFileName="G2du.swf", cAlternateFileName="")) returned 1 [0259.836] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0259.836] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.837] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0259.837] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28e9c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0259.837] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.837] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28e9c) returned 0x10ab [0259.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\G2du.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\g2du.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0259.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\47326475.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\47326475.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0259.838] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e82 [0259.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0259.838] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0259.926] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5e82, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x5e82, lpOverlapped=0x0) returned 1 [0259.927] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5e90, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x5e90, lpOverlapped=0x0) returned 1 [0259.929] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.951] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.962] CloseHandle (hObject=0x10c) returned 1 [0259.962] CloseHandle (hObject=0x104) returned 1 [0259.962] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\G2du.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\g2du.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\47326475.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\47326475.swf")) returned 0 [0259.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\47326475.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\47326475.swf")) returned 0x20 [0259.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\G2du.swf", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5766c8a0, ftCreationTime.dwHighDateTime=0x1d5c2e9, ftLastAccessTime.dwLowDateTime=0x5e4e7550, ftLastAccessTime.dwHighDateTime=0x1d5c5aa, ftLastWriteTime.dwLowDateTime=0x5e4e7550, ftLastWriteTime.dwHighDateTime=0x1d5c5aa, nFileSizeHigh=0x0, nFileSizeLow=0x5e82, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="G2du.swf", cAlternateFileName="")) returned 0x325018 [0259.963] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5766c8a0, ftCreationTime.dwHighDateTime=0x1d5c2e9, ftLastAccessTime.dwLowDateTime=0x5e4e7550, ftLastAccessTime.dwHighDateTime=0x1d5c5aa, ftLastWriteTime.dwLowDateTime=0x5e4e7550, ftLastWriteTime.dwHighDateTime=0x1d5c5aa, nFileSizeHigh=0x0, nFileSizeLow=0x5e82, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="G2du.swf", cAlternateFileName="")) returned 0 [0259.963] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0259.963] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\G2du.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\g2du.swf")) returned 1 [0259.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\G2du.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\g2du.swf")) returned 0xffffffff [0259.964] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223657a0, ftCreationTime.dwHighDateTime=0x1d5c37e, ftLastAccessTime.dwLowDateTime=0x6c61de50, ftLastAccessTime.dwHighDateTime=0x1d5b82d, ftLastWriteTime.dwLowDateTime=0x6c61de50, ftLastWriteTime.dwHighDateTime=0x1d5b82d, nFileSizeHigh=0x0, nFileSizeLow=0xde84, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="SJgVVnvxQP_-8.avi", cAlternateFileName="SJGVVN~1.AVI")) returned 1 [0259.965] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0259.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0259.965] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0259.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0259.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291cc) returned 0x10ab [0259.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\SJgVVnvxQP_-8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\sjgvvnvxqp_-8.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0259.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\534A6756566E767851505F2D38.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\534a6756566e767851505f2d38.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0259.975] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde84 [0259.975] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0259.975] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0260.048] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xde84, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xde84, lpOverlapped=0x0) returned 1 [0260.050] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xde90, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xde90, lpOverlapped=0x0) returned 1 [0260.052] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.074] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.084] CloseHandle (hObject=0x104) returned 1 [0260.084] CloseHandle (hObject=0x10c) returned 1 [0260.085] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\SJgVVnvxQP_-8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\sjgvvnvxqp_-8.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\534A6756566E767851505F2D38.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\534a6756566e767851505f2d38.avi")) returned 0 [0260.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\534A6756566E767851505F2D38.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\534a6756566e767851505f2d38.avi")) returned 0x20 [0260.086] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\SJgVVnvxQP_-8.avi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223657a0, ftCreationTime.dwHighDateTime=0x1d5c37e, ftLastAccessTime.dwLowDateTime=0x6c61de50, ftLastAccessTime.dwHighDateTime=0x1d5b82d, ftLastWriteTime.dwLowDateTime=0x6c61de50, ftLastWriteTime.dwHighDateTime=0x1d5b82d, nFileSizeHigh=0x0, nFileSizeLow=0xde84, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="SJgVVnvxQP_-8.avi", cAlternateFileName="SJGVVN~1.AVI")) returned 0x325018 [0260.086] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223657a0, ftCreationTime.dwHighDateTime=0x1d5c37e, ftLastAccessTime.dwLowDateTime=0x6c61de50, ftLastAccessTime.dwHighDateTime=0x1d5b82d, ftLastWriteTime.dwLowDateTime=0x6c61de50, ftLastWriteTime.dwHighDateTime=0x1d5b82d, nFileSizeHigh=0x0, nFileSizeLow=0xde84, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="SJgVVnvxQP_-8.avi", cAlternateFileName="SJGVVN~1.AVI")) returned 0 [0260.086] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0260.086] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\SJgVVnvxQP_-8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\sjgvvnvxqp_-8.avi")) returned 1 [0260.087] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\SJgVVnvxQP_-8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\sjgvvnvxqp_-8.avi")) returned 0xffffffff [0260.087] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff18950, ftCreationTime.dwHighDateTime=0x1d5bca2, ftLastAccessTime.dwLowDateTime=0xa35018c0, ftLastAccessTime.dwHighDateTime=0x1d5b5d3, ftLastWriteTime.dwLowDateTime=0xa35018c0, ftLastWriteTime.dwHighDateTime=0x1d5b5d3, nFileSizeHigh=0x0, nFileSizeLow=0x95d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="zEhKP8Dca4zsWYqAb.flv", cAlternateFileName="ZEHKP8~1.FLV")) returned 1 [0260.088] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0260.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0260.088] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c27f7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0260.088] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.088] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c27f7c) returned 0x10ab [0260.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\zEhKP8Dca4zsWYqAb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\zehkp8dca4zswyqab.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0260.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\7A45684B5038446361347A735759714162.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\7a45684b5038446361347a735759714162.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0260.089] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95d7 [0260.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0260.089] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0260.182] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x95d7, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x95d7, lpOverlapped=0x0) returned 1 [0260.184] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x95e0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x95e0, lpOverlapped=0x0) returned 1 [0260.186] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.208] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.219] CloseHandle (hObject=0x10c) returned 1 [0260.219] CloseHandle (hObject=0x104) returned 1 [0260.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\zEhKP8Dca4zsWYqAb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\zehkp8dca4zswyqab.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\7A45684B5038446361347A735759714162.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\7a45684b5038446361347a735759714162.flv")) returned 0 [0260.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\7A45684B5038446361347A735759714162.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\7a45684b5038446361347a735759714162.flv")) returned 0x20 [0260.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\zEhKP8Dca4zsWYqAb.flv", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff18950, ftCreationTime.dwHighDateTime=0x1d5bca2, ftLastAccessTime.dwLowDateTime=0xa35018c0, ftLastAccessTime.dwHighDateTime=0x1d5b5d3, ftLastWriteTime.dwLowDateTime=0xa35018c0, ftLastWriteTime.dwHighDateTime=0x1d5b5d3, nFileSizeHigh=0x0, nFileSizeLow=0x95d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="zEhKP8Dca4zsWYqAb.flv", cAlternateFileName="ZEHKP8~1.FLV")) returned 0x325018 [0260.220] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff18950, ftCreationTime.dwHighDateTime=0x1d5bca2, ftLastAccessTime.dwLowDateTime=0xa35018c0, ftLastAccessTime.dwHighDateTime=0x1d5b5d3, ftLastWriteTime.dwLowDateTime=0xa35018c0, ftLastWriteTime.dwHighDateTime=0x1d5b5d3, nFileSizeHigh=0x0, nFileSizeLow=0x95d7, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="zEhKP8Dca4zsWYqAb.flv", cAlternateFileName="ZEHKP8~1.FLV")) returned 0 [0260.220] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0260.221] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\zEhKP8Dca4zsWYqAb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\zehkp8dca4zswyqab.flv")) returned 1 [0260.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\zEhKP8Dca4zsWYqAb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\zehkp8dca4zswyqab.flv")) returned 0xffffffff [0260.222] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e472250, ftCreationTime.dwHighDateTime=0x1d5c5aa, ftLastAccessTime.dwLowDateTime=0x294e7d10, ftLastAccessTime.dwHighDateTime=0x1d5b73f, ftLastWriteTime.dwLowDateTime=0x294e7d10, ftLastWriteTime.dwHighDateTime=0x1d5b73f, nFileSizeHigh=0x0, nFileSizeLow=0x50f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="_GB3.flv", cAlternateFileName="")) returned 1 [0260.223] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0260.223] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.223] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0260.223] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c281dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0260.223] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.223] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c281dc) returned 0x10ab [0260.223] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\_GB3.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\_gb3.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0260.224] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\5F474233.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\5f474233.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0260.224] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50f5 [0260.224] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0260.225] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0260.311] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x50f5, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x50f5, lpOverlapped=0x0) returned 1 [0260.312] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5100, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x5100, lpOverlapped=0x0) returned 1 [0260.313] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.337] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.348] CloseHandle (hObject=0x104) returned 1 [0260.348] CloseHandle (hObject=0x10c) returned 1 [0260.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\_GB3.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\_gb3.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\5F474233.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\5f474233.flv")) returned 0 [0260.349] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\5F474233.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\5f474233.flv")) returned 0x20 [0260.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\_GB3.flv", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e472250, ftCreationTime.dwHighDateTime=0x1d5c5aa, ftLastAccessTime.dwLowDateTime=0x294e7d10, ftLastAccessTime.dwHighDateTime=0x1d5b73f, ftLastWriteTime.dwLowDateTime=0x294e7d10, ftLastWriteTime.dwHighDateTime=0x1d5b73f, nFileSizeHigh=0x0, nFileSizeLow=0x50f5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_GB3.flv", cAlternateFileName="")) returned 0x325018 [0260.350] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e472250, ftCreationTime.dwHighDateTime=0x1d5c5aa, ftLastAccessTime.dwLowDateTime=0x294e7d10, ftLastAccessTime.dwHighDateTime=0x1d5b73f, ftLastWriteTime.dwLowDateTime=0x294e7d10, ftLastWriteTime.dwHighDateTime=0x1d5b73f, nFileSizeHigh=0x0, nFileSizeLow=0x50f5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="_GB3.flv", cAlternateFileName="")) returned 0 [0260.350] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0260.350] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\_GB3.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\_gb3.flv")) returned 1 [0260.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SCzp1EW HinPZZsgc\\_GB3.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\sczp1ew hinpzzsgc\\_gb3.flv")) returned 0xffffffff [0260.351] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e472250, ftCreationTime.dwHighDateTime=0x1d5c5aa, ftLastAccessTime.dwLowDateTime=0x294e7d10, ftLastAccessTime.dwHighDateTime=0x1d5b73f, ftLastWriteTime.dwLowDateTime=0x294e7d10, ftLastWriteTime.dwHighDateTime=0x1d5b73f, nFileSizeHigh=0x0, nFileSizeLow=0x50f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="_GB3.flv", cAlternateFileName="")) returned 0 [0260.351] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0260.351] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d4c110, ftCreationTime.dwHighDateTime=0x1d5baaf, ftLastAccessTime.dwLowDateTime=0x5a6a5690, ftLastAccessTime.dwHighDateTime=0x1d5c2e7, ftLastWriteTime.dwLowDateTime=0x5a6a5690, ftLastWriteTime.dwHighDateTime=0x1d5c2e7, nFileSizeHigh=0x0, nFileSizeLow=0x5058, dwReserved0=0x71595773, dwReserved1=0x662e6241, cFileName="SsjN534mj0TYrPelGl.flv", cAlternateFileName="SSJN53~1.FLV")) returned 1 [0260.352] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0260.352] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.352] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0260.352] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29750, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0260.352] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.352] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29750) returned 0x10ab [0260.352] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SsjN534mj0TYrPelGl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\ssjn534mj0tyrpelgl.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0260.352] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\53736A4E3533346D6A3054597250656C476C.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\53736a4e3533346d6a3054597250656c476c.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0260.353] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5058 [0260.353] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0260.354] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0260.436] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5058, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x5058, lpOverlapped=0x0) returned 1 [0260.437] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x5060, lpOverlapped=0x0) returned 1 [0260.438] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.460] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.471] CloseHandle (hObject=0xfc) returned 1 [0260.471] CloseHandle (hObject=0x10c) returned 1 [0260.471] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SsjN534mj0TYrPelGl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\ssjn534mj0tyrpelgl.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\53736A4E3533346D6A3054597250656C476C.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\53736a4e3533346d6a3054597250656c476c.flv")) returned 0 [0260.472] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\53736A4E3533346D6A3054597250656C476C.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\53736a4e3533346d6a3054597250656c476c.flv")) returned 0x20 [0260.472] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SsjN534mj0TYrPelGl.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d4c110, ftCreationTime.dwHighDateTime=0x1d5baaf, ftLastAccessTime.dwLowDateTime=0x5a6a5690, ftLastAccessTime.dwHighDateTime=0x1d5c2e7, ftLastWriteTime.dwLowDateTime=0x5a6a5690, ftLastWriteTime.dwHighDateTime=0x1d5c2e7, nFileSizeHigh=0x0, nFileSizeLow=0x5058, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="SsjN534mj0TYrPelGl.flv", cAlternateFileName="SSJN53~1.FLV")) returned 0x324fd8 [0260.472] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d4c110, ftCreationTime.dwHighDateTime=0x1d5baaf, ftLastAccessTime.dwLowDateTime=0x5a6a5690, ftLastAccessTime.dwHighDateTime=0x1d5c2e7, ftLastWriteTime.dwLowDateTime=0x5a6a5690, ftLastWriteTime.dwHighDateTime=0x1d5c2e7, nFileSizeHigh=0x0, nFileSizeLow=0x5058, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="SsjN534mj0TYrPelGl.flv", cAlternateFileName="SSJN53~1.FLV")) returned 0 [0260.472] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0260.472] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SsjN534mj0TYrPelGl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\ssjn534mj0tyrpelgl.flv")) returned 1 [0260.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\B8WCF\\SsjN534mj0TYrPelGl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\b8wcf\\ssjn534mj0tyrpelgl.flv")) returned 0xffffffff [0260.474] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d4c110, ftCreationTime.dwHighDateTime=0x1d5baaf, ftLastAccessTime.dwLowDateTime=0x5a6a5690, ftLastAccessTime.dwHighDateTime=0x1d5c2e7, ftLastWriteTime.dwLowDateTime=0x5a6a5690, ftLastWriteTime.dwHighDateTime=0x1d5c2e7, nFileSizeHigh=0x0, nFileSizeLow=0x5058, dwReserved0=0x71595773, dwReserved1=0x662e6241, cFileName="SsjN534mj0TYrPelGl.flv", cAlternateFileName="SSJN53~1.FLV")) returned 0 [0260.474] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0260.474] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91113c0, ftCreationTime.dwHighDateTime=0x1d5c092, ftLastAccessTime.dwLowDateTime=0x710aabd0, ftLastAccessTime.dwHighDateTime=0x1d5b63e, ftLastWriteTime.dwLowDateTime=0x710aabd0, ftLastWriteTime.dwHighDateTime=0x1d5b63e, nFileSizeHigh=0x0, nFileSizeLow=0x1394d, dwReserved0=0x65507259, dwReserved1=0x2e6c476c, cFileName="fDIESgABicwyn1818tYB.flv", cAlternateFileName="FDIESG~1.FLV")) returned 1 [0260.475] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0260.475] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.475] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0260.475] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c298ac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0260.475] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.475] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c298ac) returned 0x10ab [0260.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\fDIESgABicwyn1818tYB.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\fdiesgabicwyn1818tyb.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0260.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\6644494553674142696377796E31383138745942.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\6644494553674142696377796e31383138745942.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0260.476] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1394d [0260.476] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0260.476] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0260.571] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1394d, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x1394d, lpOverlapped=0x0) returned 1 [0260.573] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x13950, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x13950, lpOverlapped=0x0) returned 1 [0260.576] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.598] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.608] CloseHandle (hObject=0xf0) returned 1 [0260.609] CloseHandle (hObject=0x10c) returned 1 [0260.609] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\fDIESgABicwyn1818tYB.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\fdiesgabicwyn1818tyb.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\6644494553674142696377796E31383138745942.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\6644494553674142696377796e31383138745942.flv")) returned 0 [0260.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\6644494553674142696377796E31383138745942.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\6644494553674142696377796e31383138745942.flv")) returned 0x20 [0260.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\fDIESgABicwyn1818tYB.flv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91113c0, ftCreationTime.dwHighDateTime=0x1d5c092, ftLastAccessTime.dwLowDateTime=0x710aabd0, ftLastAccessTime.dwHighDateTime=0x1d5b63e, ftLastWriteTime.dwLowDateTime=0x710aabd0, ftLastWriteTime.dwHighDateTime=0x1d5b63e, nFileSizeHigh=0x0, nFileSizeLow=0x1394d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fDIESgABicwyn1818tYB.flv", cAlternateFileName="FDIESG~1.FLV")) returned 0x324f98 [0260.610] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91113c0, ftCreationTime.dwHighDateTime=0x1d5c092, ftLastAccessTime.dwLowDateTime=0x710aabd0, ftLastAccessTime.dwHighDateTime=0x1d5b63e, ftLastWriteTime.dwLowDateTime=0x710aabd0, ftLastWriteTime.dwHighDateTime=0x1d5b63e, nFileSizeHigh=0x0, nFileSizeLow=0x1394d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="fDIESgABicwyn1818tYB.flv", cAlternateFileName="FDIESG~1.FLV")) returned 0 [0260.610] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0260.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\fDIESgABicwyn1818tYB.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\fdiesgabicwyn1818tyb.flv")) returned 1 [0260.613] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\fDIESgABicwyn1818tYB.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\fdiesgabicwyn1818tyb.flv")) returned 0xffffffff [0260.613] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84590f50, ftCreationTime.dwHighDateTime=0x1d5c030, ftLastAccessTime.dwLowDateTime=0x6d686810, ftLastAccessTime.dwHighDateTime=0x1d5c060, ftLastWriteTime.dwLowDateTime=0x6d686810, ftLastWriteTime.dwHighDateTime=0x1d5c060, nFileSizeHigh=0x0, nFileSizeLow=0x458e, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="gOzdYe.flv", cAlternateFileName="")) returned 1 [0260.614] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0260.614] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.614] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0260.614] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c299cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0260.614] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.614] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c299cc) returned 0x10ab [0260.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\gOzdYe.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\gozdye.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0260.615] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\674F7A645965.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\674f7a645965.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0260.615] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x458e [0260.615] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0260.616] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0260.687] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x458e, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x458e, lpOverlapped=0x0) returned 1 [0260.689] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x4590, lpOverlapped=0x0) returned 1 [0260.690] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.712] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.723] CloseHandle (hObject=0x10c) returned 1 [0260.723] CloseHandle (hObject=0xf0) returned 1 [0260.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\gOzdYe.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\gozdye.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\674F7A645965.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\674f7a645965.flv")) returned 0 [0260.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\674F7A645965.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\674f7a645965.flv")) returned 0x20 [0260.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\gOzdYe.flv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84590f50, ftCreationTime.dwHighDateTime=0x1d5c030, ftLastAccessTime.dwLowDateTime=0x6d686810, ftLastAccessTime.dwHighDateTime=0x1d5c060, ftLastWriteTime.dwLowDateTime=0x6d686810, ftLastWriteTime.dwHighDateTime=0x1d5c060, nFileSizeHigh=0x0, nFileSizeLow=0x458e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="gOzdYe.flv", cAlternateFileName="")) returned 0x324f98 [0260.724] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84590f50, ftCreationTime.dwHighDateTime=0x1d5c030, ftLastAccessTime.dwLowDateTime=0x6d686810, ftLastAccessTime.dwHighDateTime=0x1d5c060, ftLastWriteTime.dwLowDateTime=0x6d686810, ftLastWriteTime.dwHighDateTime=0x1d5c060, nFileSizeHigh=0x0, nFileSizeLow=0x458e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="gOzdYe.flv", cAlternateFileName="")) returned 0 [0260.724] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0260.724] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\gOzdYe.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\gozdye.flv")) returned 1 [0260.726] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\gOzdYe.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\gozdye.flv")) returned 0xffffffff [0260.726] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0ea6c0, ftCreationTime.dwHighDateTime=0x1d5c070, ftLastAccessTime.dwLowDateTime=0x9114ee80, ftLastAccessTime.dwHighDateTime=0x1d5b75c, ftLastWriteTime.dwLowDateTime=0x9114ee80, ftLastWriteTime.dwHighDateTime=0x1d5b75c, nFileSizeHigh=0x0, nFileSizeLow=0x10ca6, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="iec1SqsOFx.avi", cAlternateFileName="IEC1SQ~1.AVI")) returned 1 [0260.726] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0260.726] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.726] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0260.726] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c288e0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0260.726] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.727] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c288e0) returned 0x10ab [0260.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\iec1SqsOFx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\iec1sqsofx.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0260.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\696563315371734F4678.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\696563315371734f4678.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0260.727] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10ca6 [0260.728] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0260.728] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0260.813] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10ca6, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x10ca6, lpOverlapped=0x0) returned 1 [0260.815] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x10cb0, lpOverlapped=0x0) returned 1 [0260.817] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.839] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.850] CloseHandle (hObject=0xf0) returned 1 [0260.850] CloseHandle (hObject=0x10c) returned 1 [0260.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\iec1SqsOFx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\iec1sqsofx.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\696563315371734F4678.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\696563315371734f4678.avi")) returned 0 [0260.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\696563315371734F4678.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\696563315371734f4678.avi")) returned 0x20 [0260.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\iec1SqsOFx.avi", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0ea6c0, ftCreationTime.dwHighDateTime=0x1d5c070, ftLastAccessTime.dwLowDateTime=0x9114ee80, ftLastAccessTime.dwHighDateTime=0x1d5b75c, ftLastWriteTime.dwLowDateTime=0x9114ee80, ftLastWriteTime.dwHighDateTime=0x1d5b75c, nFileSizeHigh=0x0, nFileSizeLow=0x10ca6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="iec1SqsOFx.avi", cAlternateFileName="IEC1SQ~1.AVI")) returned 0x324f98 [0260.851] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0ea6c0, ftCreationTime.dwHighDateTime=0x1d5c070, ftLastAccessTime.dwLowDateTime=0x9114ee80, ftLastAccessTime.dwHighDateTime=0x1d5b75c, ftLastWriteTime.dwLowDateTime=0x9114ee80, ftLastWriteTime.dwHighDateTime=0x1d5b75c, nFileSizeHigh=0x0, nFileSizeLow=0x10ca6, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="iec1SqsOFx.avi", cAlternateFileName="IEC1SQ~1.AVI")) returned 0 [0260.851] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0260.851] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\iec1SqsOFx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\iec1sqsofx.avi")) returned 1 [0260.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\iec1SqsOFx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\iec1sqsofx.avi")) returned 0xffffffff [0260.852] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283ab3b0, ftCreationTime.dwHighDateTime=0x1d5b85e, ftLastAccessTime.dwLowDateTime=0xfa511720, ftLastAccessTime.dwHighDateTime=0x1d5c44a, ftLastWriteTime.dwLowDateTime=0xfa511720, ftLastWriteTime.dwHighDateTime=0x1d5c44a, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="qVSwND72LMnoyfNm8fe.mkv", cAlternateFileName="QVSWND~1.MKV")) returned 1 [0260.853] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0260.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0260.853] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29c50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0260.853] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0260.853] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29c50) returned 0x10ab [0260.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\qVSwND72LMnoyfNm8fe.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\qvswnd72lmnoyfnm8fe.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0260.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\715653774E4437324C4D6E6F79664E6D386665.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\715653774e4437324c4d6e6f79664e6d386665.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0260.854] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x138c [0260.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0260.854] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0260.941] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x138c, lpOverlapped=0x0) returned 1 [0260.941] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x1390, lpOverlapped=0x0) returned 1 [0260.942] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.964] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.999] CloseHandle (hObject=0x10c) returned 1 [0260.999] CloseHandle (hObject=0xf0) returned 1 [0261.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\qVSwND72LMnoyfNm8fe.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\qvswnd72lmnoyfnm8fe.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\715653774E4437324C4D6E6F79664E6D386665.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\715653774e4437324c4d6e6f79664e6d386665.mkv")) returned 0 [0261.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\715653774E4437324C4D6E6F79664E6D386665.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\715653774e4437324c4d6e6f79664e6d386665.mkv")) returned 0x20 [0261.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\qVSwND72LMnoyfNm8fe.mkv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283ab3b0, ftCreationTime.dwHighDateTime=0x1d5b85e, ftLastAccessTime.dwLowDateTime=0xfa511720, ftLastAccessTime.dwHighDateTime=0x1d5c44a, ftLastWriteTime.dwLowDateTime=0xfa511720, ftLastWriteTime.dwHighDateTime=0x1d5c44a, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qVSwND72LMnoyfNm8fe.mkv", cAlternateFileName="QVSWND~1.MKV")) returned 0x324f98 [0261.003] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283ab3b0, ftCreationTime.dwHighDateTime=0x1d5b85e, ftLastAccessTime.dwLowDateTime=0xfa511720, ftLastAccessTime.dwHighDateTime=0x1d5c44a, ftLastWriteTime.dwLowDateTime=0xfa511720, ftLastWriteTime.dwHighDateTime=0x1d5c44a, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qVSwND72LMnoyfNm8fe.mkv", cAlternateFileName="QVSWND~1.MKV")) returned 0 [0261.003] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0261.003] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\qVSwND72LMnoyfNm8fe.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\qvswnd72lmnoyfnm8fe.mkv")) returned 1 [0261.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EXAA7\\qVSwND72LMnoyfNm8fe.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\exaa7\\qvswnd72lmnoyfnm8fe.mkv")) returned 0xffffffff [0261.005] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f5fac0, ftCreationTime.dwHighDateTime=0x1d5b664, ftLastAccessTime.dwLowDateTime=0xe44ae00, ftLastAccessTime.dwHighDateTime=0x1d5bca7, ftLastWriteTime.dwLowDateTime=0xe44ae00, ftLastWriteTime.dwHighDateTime=0x1d5bca7, nFileSizeHigh=0x0, nFileSizeLow=0x11da6, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="tCM3IZqz6brOi.mp4", cAlternateFileName="TCM3IZ~1.MP4")) returned 1 [0261.008] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0261.008] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.011] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0261.011] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29f60, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0261.011] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.011] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29f60) returned 0x10ab [0261.011] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6cfc4d0, ftCreationTime.dwHighDateTime=0x1d5b915, ftLastAccessTime.dwLowDateTime=0xd056abd0, ftLastAccessTime.dwHighDateTime=0x1d5be80, ftLastWriteTime.dwLowDateTime=0xd056abd0, ftLastWriteTime.dwHighDateTime=0x1d5be80, nFileSizeHigh=0x0, nFileSizeLow=0x9cf, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="vpniWFFA6wAkRpyimM_3.mp4", cAlternateFileName="VPNIWF~1.MP4")) returned 1 [0261.012] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0261.012] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.012] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0261.012] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29ffc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0261.012] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.012] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29ffc) returned 0x10ab [0261.012] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6cfc4d0, ftCreationTime.dwHighDateTime=0x1d5b915, ftLastAccessTime.dwLowDateTime=0xd056abd0, ftLastAccessTime.dwHighDateTime=0x1d5be80, ftLastWriteTime.dwLowDateTime=0xd056abd0, ftLastWriteTime.dwHighDateTime=0x1d5be80, nFileSizeHigh=0x0, nFileSizeLow=0x9cf, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="vpniWFFA6wAkRpyimM_3.mp4", cAlternateFileName="VPNIWF~1.MP4")) returned 0 [0261.012] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0261.012] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c08c50, ftCreationTime.dwHighDateTime=0x1d5bc73, ftLastAccessTime.dwLowDateTime=0x753ba800, ftLastAccessTime.dwHighDateTime=0x1d5c3f7, ftLastWriteTime.dwLowDateTime=0x753ba800, ftLastWriteTime.dwHighDateTime=0x1d5c3f7, nFileSizeHigh=0x0, nFileSizeLow=0x8ea9, dwReserved0=0x7970526b, dwReserved1=0x5f4d6d69, cFileName="R22 1tW-7gS.mp4", cAlternateFileName="R221TW~1.MP4")) returned 1 [0261.012] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0261.012] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.012] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0261.012] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0261.012] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.013] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a064) returned 0x10ab [0261.013] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d947b00, ftCreationTime.dwHighDateTime=0x1d5c29f, ftLastAccessTime.dwLowDateTime=0x44502d80, ftLastAccessTime.dwHighDateTime=0x1d5bd56, ftLastWriteTime.dwLowDateTime=0x44502d80, ftLastWriteTime.dwHighDateTime=0x1d5bd56, nFileSizeHigh=0x0, nFileSizeLow=0x141a7, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="xJikELIxdQ0.mp4", cAlternateFileName="XJIKEL~1.MP4")) returned 1 [0261.013] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0261.013] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.013] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0261.013] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a0cc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0261.013] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.013] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a0cc) returned 0x10ab [0261.013] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d947b00, ftCreationTime.dwHighDateTime=0x1d5c29f, ftLastAccessTime.dwLowDateTime=0x44502d80, ftLastAccessTime.dwHighDateTime=0x1d5bd56, ftLastWriteTime.dwLowDateTime=0x44502d80, ftLastWriteTime.dwHighDateTime=0x1d5bd56, nFileSizeHigh=0x0, nFileSizeLow=0x141a7, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="xJikELIxdQ0.mp4", cAlternateFileName="XJIKEL~1.MP4")) returned 0 [0261.013] FindClose (in: hFindFile=0x324f18 | out: hFindFile=0x324f18) returned 1 [0261.013] FindNextFileA (in: hFindFile=0x31b3b0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f5cee90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f5cee90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 0 [0261.014] FindClose (in: hFindFile=0x31b3b0 | out: hFindFile=0x31b3b0) returned 1 [0261.014] FindNextFileA (in: hFindFile=0x31b370, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x64623838, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0261.014] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34706d2e, dwReserved1=0x732e736e, cFileName=".", cAlternateFileName="")) returned 0x324f18 [0261.015] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34706d2e, dwReserved1=0x732e736e, cFileName="..", cAlternateFileName="")) returned 1 [0261.015] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34706d2e, dwReserved1=0x732e736e, cFileName="Adobe", cAlternateFileName="")) returned 1 [0261.015] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0261.015] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="..", cAlternateFileName="")) returned 1 [0261.015] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0261.015] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0261.015] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.015] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0261.015] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0261.016] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.016] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0261.016] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0261.017] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.017] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0261.017] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0261.017] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.017] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1 [0261.018] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0261.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0261.018] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a450, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0261.018] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.018] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a450) returned 0x10ab [0261.018] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 0 [0261.018] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0261.018] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0261.018] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0261.018] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0261.018] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0261.018] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0261.018] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0261.018] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="ARM", cAlternateFileName="")) returned 1 [0261.018] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0261.019] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.019] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0261.019] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0261.020] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.020] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1 [0261.021] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0261.021] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.021] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0261.021] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a590, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0261.021] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.021] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a590) returned 0x10ab [0261.021] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0261.021] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\416462655264725365635570643130313131.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\416462655264725365635570643130313131.msp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0261.022] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d800 [0261.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0261.022] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0261.126] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d800, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x3d800, lpOverlapped=0x0) returned 1 [0261.133] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3d810, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x3d810, lpOverlapped=0x0) returned 1 [0261.137] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.159] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.170] CloseHandle (hObject=0x10c) returned 1 [0261.170] CloseHandle (hObject=0xfc) returned 1 [0261.170] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\416462655264725365635570643130313131.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\416462655264725365635570643130313131.msp")) returned 0 [0261.171] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\416462655264725365635570643130313131.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\416462655264725365635570643130313131.msp")) returned 0x20 [0261.171] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 0x325018 [0261.171] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 0 [0261.171] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0261.171] DeleteFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp")) returned 1 [0261.173] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp")) returned 0xffffffff [0261.173] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1 [0261.174] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0261.174] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.174] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0261.174] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c28e10, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0261.174] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0261.174] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c28e10) returned 0x10ab [0261.175] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0261.175] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\4164626552647255706431303131305F4D5549.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\4164626552647255706431303131305f4d5549.msp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0261.175] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e3000 [0261.175] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0261.176] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0261.251] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0261.481] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0261.576] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0261.749] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0261.869] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0261.989] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0262.110] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1e3000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x1e3000, lpOverlapped=0x0) returned 1 [0262.155] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1e3010, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x1e3010, lpOverlapped=0x0) returned 1 [0262.192] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.214] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.225] CloseHandle (hObject=0xfc) returned 1 [0262.225] CloseHandle (hObject=0x10c) returned 1 [0262.225] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\4164626552647255706431303131305F4D5549.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\4164626552647255706431303131305f4d5549.msp")) returned 0 [0262.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\4164626552647255706431303131305F4D5549.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\4164626552647255706431303131305f4d5549.msp")) returned 0x20 [0262.226] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 0x325018 [0262.226] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 0 [0262.226] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0262.226] DeleteFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp")) returned 1 [0262.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp")) returned 0xffffffff [0262.235] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1 [0262.236] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0262.236] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0262.236] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0262.236] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a6e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0262.236] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0262.236] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a6e4) returned 0x10ab [0262.236] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0262.237] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\4164626552647255706431303131365F4D5549.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\4164626552647255706431303131365f4d5549.msp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0262.237] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109d000 [0262.237] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0262.237] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0262.328] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0262.585] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0262.689] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0262.842] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0262.954] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0263.083] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x500000, lpOverlapped=0x0) returned 1 [0263.198] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x19d000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x19d000, lpOverlapped=0x0) returned 1 [0263.240] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x19d010, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x19d010, lpOverlapped=0x0) returned 1 [0263.273] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.295] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.306] CloseHandle (hObject=0x10c) returned 1 [0263.306] CloseHandle (hObject=0xfc) returned 1 [0263.306] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\4164626552647255706431303131365F4D5549.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\4164626552647255706431303131365f4d5549.msp")) returned 0 [0263.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\4164626552647255706431303131365F4D5549.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\4164626552647255706431303131365f4d5549.msp")) returned 0x20 [0263.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0x325018 [0263.307] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0 [0263.307] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0263.307] DeleteFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp")) returned 1 [0263.317] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp")) returned 0xffffffff [0263.317] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0 [0263.317] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0263.317] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0263.317] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0263.317] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="ARM", cAlternateFileName="")) returned 0 [0263.317] FindClose (in: hFindFile=0x324f58 | out: hFindFile=0x324f58) returned 1 [0263.317] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0263.317] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="ARM", cAlternateFileName="\x18O2")) returned 0xffffffff [0263.318] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Desktop", cAlternateFileName="")) returned 1 [0263.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="ARM", cAlternateFileName="\x18O2")) returned 0xffffffff [0263.318] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0263.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="ARM", cAlternateFileName="\x18O2")) returned 0xffffffff [0263.318] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0263.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Favorites\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f440, dwReserved1=0x18f45c, cFileName="ARM", cAlternateFileName="\x18O2")) returned 0xffffffff [0263.318] FindNextFileA (in: hFindFile=0x324f18, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0263.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName=".", cAlternateFileName="")) returned 0x324f58 [0263.318] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="..", cAlternateFileName="")) returned 1 [0263.318] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0263.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0263.319] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0263.319] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Client", cAlternateFileName="")) returned 1 [0263.319] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0263.319] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.319] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0263.319] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0263.320] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.320] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0263.320] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0263.322] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.323] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1 [0263.323] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.323] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.324] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.324] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29394, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.324] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.324] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29394) returned 0x10ab [0263.324] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1 [0263.324] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.324] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.324] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.324] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29448, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.324] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.324] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29448) returned 0x10ab [0263.324] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1 [0263.325] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.325] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.325] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.325] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c294fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.325] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.325] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c294fc) returned 0x10ab [0263.325] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1 [0263.325] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.325] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.325] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.326] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a6fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.326] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a6fc) returned 0x10ab [0263.326] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1 [0263.326] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.326] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.326] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a76c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.326] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.326] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a76c) returned 0x10ab [0263.326] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1 [0263.327] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.327] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.327] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.327] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a710, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.327] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.327] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a710) returned 0x10ab [0263.327] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1 [0263.327] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.327] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.327] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.327] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c292e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.327] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.328] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c292e4) returned 0x10ab [0263.328] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0 [0263.328] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0263.328] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0263.328] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0263.328] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0263.328] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0263.329] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Client", cAlternateFileName="")) returned 0 [0263.329] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0263.329] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="Crypto", cAlternateFileName="")) returned 1 [0263.329] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0263.329] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0263.329] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="DSS", cAlternateFileName="")) returned 1 [0263.329] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0263.329] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.329] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0263.329] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0263.330] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.330] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.330] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0263.330] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0263.330] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0263.330] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Keys", cAlternateFileName="")) returned 1 [0263.330] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0263.331] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.331] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.331] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0263.331] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="RSA", cAlternateFileName="")) returned 1 [0263.331] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0263.331] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.332] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0263.332] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0263.332] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.332] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.332] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0263.332] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0263.332] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0263.333] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.333] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1 [0263.333] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.333] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.333] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.334] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a6fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.334] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.334] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a6fc) returned 0x10ab [0263.334] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0263.334] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\36643134653462316438636137373362616237383564316265303332353436655F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\36643134653462316438636137373362616237383564316265303332353436655f30333033643562342d666665392d343730652d396464382d376439656334313665353366"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0263.336] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f [0263.336] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0263.337] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0263.440] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x2f, lpOverlapped=0x0) returned 1 [0263.441] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x30, lpOverlapped=0x0) returned 1 [0263.442] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.470] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.481] CloseHandle (hObject=0x10c) returned 1 [0263.481] CloseHandle (hObject=0x104) returned 1 [0263.482] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\36643134653462316438636137373362616237383564316265303332353436655F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\36643134653462316438636137373362616237383564316265303332353436655f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0 [0263.482] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\36643134653462316438636137373362616237383564316265303332353436655F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\36643134653462316438636137373362616237383564316265303332353436655f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0x2020 [0263.482] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 0x325058 [0263.483] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 0 [0263.483] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0263.483] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 1 [0263.484] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0xffffffff [0263.484] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1 [0263.484] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.484] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.485] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a848, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.485] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a848) returned 0x10ab [0263.485] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0263.485] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\64343263633063333835386135386462326462333736353832313965363430305F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\64343263633063333835386135386462326462333736353832313965363430305f30333033643562342d666665392d343730652d396464382d376439656334313665353366"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0263.486] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41d [0263.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0263.486] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0263.574] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x41d, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x41d, lpOverlapped=0x0) returned 1 [0263.576] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x420, lpOverlapped=0x0) returned 1 [0263.577] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.600] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.664] CloseHandle (hObject=0x104) returned 1 [0263.664] CloseHandle (hObject=0x10c) returned 1 [0263.664] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\64343263633063333835386135386462326462333736353832313965363430305F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\64343263633063333835386135386462326462333736353832313965363430305f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0 [0263.665] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\64343263633063333835386135386462326462333736353832313965363430305F30333033643562342D666665392D343730652D396464382D376439656334313665353366" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\64343263633063333835386135386462326462333736353832313965363430305f30333033643562342d666665392d343730652d396464382d376439656334313665353366")) returned 0x2020 [0263.665] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0x325058 [0263.665] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0 [0263.665] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0263.665] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 1 [0263.666] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0xffffffff [0263.666] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0 [0263.666] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0263.666] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0263.666] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0263.666] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="RSA", cAlternateFileName="")) returned 0 [0263.666] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0263.666] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0263.666] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0263.666] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0263.667] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Device", cAlternateFileName="")) returned 1 [0263.667] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0263.669] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName="..", cAlternateFileName="")) returned 1 [0263.669] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0263.669] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0263.671] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.671] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0263.672] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.672] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.672] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.672] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.672] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.672] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad48) returned 0x10ab [0263.672] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0263.673] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6261636B67726F756E64.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6261636b67726f756e64.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0263.675] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0263.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0263.675] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0263.747] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x1fad1, lpOverlapped=0x0) returned 1 [0263.751] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x1fae0, lpOverlapped=0x0) returned 1 [0263.754] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.776] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.787] CloseHandle (hObject=0x10c) returned 1 [0263.787] CloseHandle (hObject=0x104) returned 1 [0263.787] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6261636B67726F756E64.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6261636b67726f756e64.png")) returned 0 [0263.787] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6261636B67726F756E64.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6261636b67726f756e64.png")) returned 0x20 [0263.787] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="background.png", cAlternateFileName="")) returned 0x325058 [0263.787] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="background.png", cAlternateFileName="")) returned 0 [0263.787] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0263.787] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0 [0263.788] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0263.788] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0263.789] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.789] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.789] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.789] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ad48, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.789] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.789] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ad48) returned 0x10ab [0263.789] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0263.797] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6265686176696F72.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6265686176696f72.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0263.798] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb61 [0263.798] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0263.798] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0263.885] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xb61, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xb61, lpOverlapped=0x0) returned 1 [0263.887] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xb70, lpOverlapped=0x0) returned 1 [0263.888] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.909] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.922] CloseHandle (hObject=0x104) returned 1 [0263.922] CloseHandle (hObject=0x10c) returned 1 [0263.922] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6265686176696F72.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6265686176696f72.xml")) returned 0 [0263.923] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6265686176696F72.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6265686176696f72.xml")) returned 0x20 [0263.923] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="behavior.xml", cAlternateFileName="")) returned 0x325058 [0263.923] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="behavior.xml", cAlternateFileName="")) returned 0 [0263.923] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0263.923] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0 [0263.923] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0263.923] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="device.png", cAlternateFileName="")) returned 1 [0263.924] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0263.924] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.924] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0263.924] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0263.924] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b024, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0263.924] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0263.924] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b024) returned 0x10ab [0263.924] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0263.924] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0263.925] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\646576696365.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\646576696365.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0263.925] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadc8 [0263.925] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0263.926] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0264.013] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xadc8, lpOverlapped=0x0) returned 1 [0264.174] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xadd0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xadd0, lpOverlapped=0x0) returned 1 [0264.175] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.197] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.208] CloseHandle (hObject=0x10c) returned 1 [0264.208] CloseHandle (hObject=0x104) returned 1 [0264.208] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\646576696365.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\646576696365.png")) returned 0 [0264.208] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\646576696365.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\646576696365.png")) returned 0x20 [0264.209] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="device.png", cAlternateFileName="")) returned 0x325058 [0264.209] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="device.png", cAlternateFileName="")) returned 0 [0264.209] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0264.209] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0 [0264.209] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0264.209] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0264.210] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0264.210] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.210] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0264.210] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0264.210] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.211] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae4c) returned 0x10ab [0264.211] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0264.211] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6F7665726C6179.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6f7665726c6179.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0264.211] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0264.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0264.212] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0264.305] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x70c1, lpOverlapped=0x0) returned 1 [0264.337] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x70d0, lpOverlapped=0x0) returned 1 [0264.338] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.361] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.371] CloseHandle (hObject=0x104) returned 1 [0264.371] CloseHandle (hObject=0x10c) returned 1 [0264.371] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6F7665726C6179.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6f7665726c6179.png")) returned 0 [0264.372] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6F7665726C6179.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\6f7665726c6179.png")) returned 0x20 [0264.372] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="overlay.png", cAlternateFileName="")) returned 0x325058 [0264.372] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="overlay.png", cAlternateFileName="")) returned 0 [0264.373] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0264.373] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0 [0264.373] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0264.373] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0264.374] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0264.374] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.374] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0264.374] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2988c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0264.374] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.374] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2988c) returned 0x10ab [0264.374] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0264.376] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\7375706572626172.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\7375706572626172.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0264.376] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99d3 [0264.376] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0264.377] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0264.434] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x99d3, lpOverlapped=0x0) returned 1 [0264.450] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x99e0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x99e0, lpOverlapped=0x0) returned 1 [0264.451] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.473] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.484] CloseHandle (hObject=0x10c) returned 1 [0264.484] CloseHandle (hObject=0x104) returned 1 [0264.484] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\7375706572626172.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\7375706572626172.png")) returned 0 [0264.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\7375706572626172.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\7375706572626172.png")) returned 0x20 [0264.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="superbar.png", cAlternateFileName="")) returned 0x325058 [0264.485] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0264.485] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0264.485] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0 [0264.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0264.485] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0264.485] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0264.485] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676e67, dwReserved1=0x62643262, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0264.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x325018 [0264.485] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0264.486] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="background.png", cAlternateFileName="")) returned 1 [0264.486] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0264.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0264.486] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aec8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0264.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aec8) returned 0x10ab [0264.486] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0264.487] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6261636B67726F756E64.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6261636b67726f756e64.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0264.499] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0264.500] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0264.500] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0264.534] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x1fad1, lpOverlapped=0x0) returned 1 [0264.554] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x1fae0, lpOverlapped=0x0) returned 1 [0264.557] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.580] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.601] CloseHandle (hObject=0x104) returned 1 [0264.601] CloseHandle (hObject=0x10c) returned 1 [0264.601] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6261636B67726F756E64.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6261636b67726f756e64.png")) returned 0 [0264.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6261636B67726F756E64.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6261636b67726f756e64.png")) returned 0x20 [0264.601] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="background.png", cAlternateFileName="")) returned 0x325058 [0264.601] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="background.png", cAlternateFileName="")) returned 0 [0264.601] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0264.601] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0 [0264.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0264.601] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0264.602] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0264.602] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.602] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0264.602] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29960, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0264.602] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.602] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29960) returned 0x10ab [0264.603] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0264.603] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6265686176696F72.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6265686176696f72.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0264.603] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x769 [0264.604] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0264.604] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0264.637] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x769, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x769, lpOverlapped=0x0) returned 1 [0264.639] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x770, lpOverlapped=0x0) returned 1 [0264.640] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.663] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.674] CloseHandle (hObject=0x10c) returned 1 [0264.674] CloseHandle (hObject=0x104) returned 1 [0264.674] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6265686176696F72.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6265686176696f72.xml")) returned 0 [0264.674] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6265686176696F72.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\6265686176696f72.xml")) returned 0x20 [0264.674] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="behavior.xml", cAlternateFileName="")) returned 0x325058 [0264.674] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="behavior.xml", cAlternateFileName="")) returned 0 [0264.674] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0264.675] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0 [0264.675] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0264.675] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0264.675] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0264.675] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.675] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0264.675] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0264.676] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b00c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0264.676] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.676] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b00c) returned 0x10ab [0264.676] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0264.676] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0264.676] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\77617465726D61726B.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\77617465726d61726b.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0264.677] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0264.677] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0264.677] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0264.755] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x70c1, lpOverlapped=0x0) returned 1 [0264.832] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x70d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x70d0, lpOverlapped=0x0) returned 1 [0264.834] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.856] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.866] CloseHandle (hObject=0x104) returned 1 [0264.866] CloseHandle (hObject=0x10c) returned 1 [0264.867] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\77617465726D61726B.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\77617465726d61726b.png")) returned 0 [0264.867] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\77617465726D61726B.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\77617465726d61726b.png")) returned 0x20 [0264.867] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="watermark.png", cAlternateFileName="")) returned 0x325058 [0264.867] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0264.867] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0264.867] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0 [0264.867] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0264.867] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0264.867] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0264.867] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676e67, dwReserved1=0x62643262, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0264.867] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0264.868] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 1 [0264.868] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0264.868] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName="..", cAlternateFileName="")) returned 1 [0264.868] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0264.868] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x325018 [0264.870] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0264.870] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="en-US", cAlternateFileName="")) returned 1 [0264.870] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0264.871] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.871] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0264.871] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0264.871] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.871] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0264.872] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0264.872] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b048, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0264.872] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.872] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b048) returned 0x10ab [0264.872] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0264.872] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0264.873] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\7265736f75726365.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0264.874] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x536 [0264.874] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0264.874] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0264.922] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x536, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x536, lpOverlapped=0x0) returned 1 [0264.923] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x540, lpOverlapped=0x0) returned 1 [0264.924] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.947] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.958] CloseHandle (hObject=0x104) returned 1 [0264.958] CloseHandle (hObject=0x100) returned 1 [0264.958] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\7265736f75726365.xml")) returned 0 [0264.958] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\7265736f75726365.xml")) returned 0x20 [0264.958] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="resource.xml", cAlternateFileName="")) returned 0x325098 [0264.958] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0264.958] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0264.959] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0 [0264.959] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20 [0264.959] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0264.959] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0264.959] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x7735386c, dwReserved1=0x7758b613, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0264.959] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0264.959] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.960] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0264.960] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29a94, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0264.960] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0264.960] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29a94) returned 0x10ab [0264.960] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0264.960] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\666F6C646572.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\666f6c646572.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0264.961] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0264.961] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0264.961] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0264.994] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xd0a3, lpOverlapped=0x0) returned 1 [0264.997] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xd0b0, lpOverlapped=0x0) returned 1 [0264.998] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.021] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.031] CloseHandle (hObject=0x10c) returned 1 [0265.031] CloseHandle (hObject=0x100) returned 1 [0265.031] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\666F6C646572.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\666f6c646572.ico")) returned 0 [0265.032] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\666F6C646572.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\666f6c646572.ico")) returned 0x20 [0265.032] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="folder.ico", cAlternateFileName="")) returned 0x325058 [0265.032] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0265.032] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0265.032] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0 [0265.032] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20 [0265.032] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0265.033] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0265.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0265.033] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0265.033] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b030, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0265.033] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.033] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b030) returned 0x10ab [0265.033] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0265.034] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0265.034] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\6E6574666F6C.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\6e6574666f6c.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0265.034] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72ee [0265.034] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0265.035] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0265.078] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x72ee, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x72ee, lpOverlapped=0x0) returned 1 [0265.080] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x72f0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x72f0, lpOverlapped=0x0) returned 1 [0265.082] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.104] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.115] CloseHandle (hObject=0x100) returned 1 [0265.115] CloseHandle (hObject=0x10c) returned 1 [0265.115] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\6E6574666F6C.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\6e6574666f6c.ico")) returned 0 [0265.115] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\6E6574666F6C.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\6e6574666f6c.ico")) returned 0x20 [0265.115] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="netfol.ico", cAlternateFileName="")) returned 0x325058 [0265.116] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="netfol.ico", cAlternateFileName="")) returned 0 [0265.116] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0265.116] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0 [0265.116] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0x20 [0265.116] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0265.117] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0265.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0265.117] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0265.117] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b02c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0265.117] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.117] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b02c) returned 0x10ab [0265.117] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0265.117] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0265.118] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7069637475726573.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7069637475726573.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0265.118] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14668 [0265.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0265.119] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0265.163] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x14668, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x14668, lpOverlapped=0x0) returned 1 [0265.166] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x14670, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x14670, lpOverlapped=0x0) returned 1 [0265.168] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.190] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.201] CloseHandle (hObject=0x10c) returned 1 [0265.201] CloseHandle (hObject=0x100) returned 1 [0265.202] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7069637475726573.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7069637475726573.ico")) returned 0 [0265.202] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7069637475726573.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7069637475726573.ico")) returned 0x20 [0265.202] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="pictures.ico", cAlternateFileName="")) returned 0x325058 [0265.202] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="pictures.ico", cAlternateFileName="")) returned 0 [0265.202] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0265.202] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0 [0265.202] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0x20 [0265.202] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0265.203] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0265.203] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.203] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0265.203] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0265.204] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0265.204] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.204] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a8) returned 0x10ab [0265.204] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0265.204] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0265.205] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7265736f75726365.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0265.205] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x536 [0265.206] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0265.206] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0265.294] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x536, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x536, lpOverlapped=0x0) returned 1 [0265.296] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x540, lpOverlapped=0x0) returned 1 [0265.297] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.320] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.331] CloseHandle (hObject=0x100) returned 1 [0265.332] CloseHandle (hObject=0x10c) returned 1 [0265.332] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7265736f75726365.xml")) returned 0 [0265.332] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7265736f75726365.xml")) returned 0x20 [0265.332] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="resource.xml", cAlternateFileName="")) returned 0x325058 [0265.332] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0265.332] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0265.332] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0 [0265.332] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20 [0265.333] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0265.334] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0265.334] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.334] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0265.334] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0265.334] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afc4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0265.334] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.334] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afc4) returned 0x10ab [0265.334] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0265.334] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0265.335] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\72696E67746F6E6573.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\72696e67746f6e6573.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0265.335] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcaa9 [0265.335] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0265.336] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0265.429] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xcaa9, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xcaa9, lpOverlapped=0x0) returned 1 [0265.432] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xcab0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xcab0, lpOverlapped=0x0) returned 1 [0265.434] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.456] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.467] CloseHandle (hObject=0x10c) returned 1 [0265.467] CloseHandle (hObject=0x100) returned 1 [0265.467] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\72696E67746F6E6573.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\72696e67746f6e6573.ico")) returned 0 [0265.468] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\72696E67746F6E6573.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\72696e67746f6e6573.ico")) returned 0x20 [0265.468] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ringtones.ico", cAlternateFileName="")) returned 0x325058 [0265.468] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ringtones.ico", cAlternateFileName="")) returned 0 [0265.468] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0265.468] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0 [0265.468] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0x20 [0265.468] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0265.469] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0265.469] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.469] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0265.469] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0265.469] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0265.469] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.469] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0265.469] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0265.470] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0265.470] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73657474696E6773.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73657474696e6773.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0265.471] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10850 [0265.471] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0265.471] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0265.559] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10850, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x10850, lpOverlapped=0x0) returned 1 [0265.562] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10860, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x10860, lpOverlapped=0x0) returned 1 [0265.564] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.587] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.597] CloseHandle (hObject=0x100) returned 1 [0265.597] CloseHandle (hObject=0x10c) returned 1 [0265.615] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73657474696E6773.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73657474696e6773.ico")) returned 0 [0265.618] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73657474696E6773.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73657474696e6773.ico")) returned 0x20 [0265.618] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="settings.ico", cAlternateFileName="")) returned 0x325058 [0265.620] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="settings.ico", cAlternateFileName="")) returned 0 [0265.620] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0265.621] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0 [0265.623] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0x20 [0265.624] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0265.625] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0265.625] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.625] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0265.626] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0265.626] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b028, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0265.626] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.626] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b028) returned 0x10ab [0265.626] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0265.626] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0265.626] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73796E63.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73796e63.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0265.627] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc04b [0265.627] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0265.627] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0265.699] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc04b, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xc04b, lpOverlapped=0x0) returned 1 [0265.702] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xc050, lpOverlapped=0x0) returned 1 [0265.703] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.727] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.737] CloseHandle (hObject=0x10c) returned 1 [0265.737] CloseHandle (hObject=0x100) returned 1 [0265.738] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73796E63.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73796e63.ico")) returned 0 [0265.738] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73796E63.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\73796e63.ico")) returned 0x20 [0265.738] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sync.ico", cAlternateFileName="")) returned 0x325058 [0265.739] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="sync.ico", cAlternateFileName="")) returned 0 [0265.739] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0265.739] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0 [0265.739] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0x20 [0265.739] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0265.740] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0265.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0265.740] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0265.740] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b08c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0265.740] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.740] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b08c) returned 0x10ab [0265.740] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0265.741] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0265.742] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7461736B73.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7461736b73.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0265.742] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3473 [0265.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0265.742] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0265.829] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3473, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x3473, lpOverlapped=0x0) returned 1 [0265.831] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x3480, lpOverlapped=0x0) returned 1 [0265.832] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.859] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.870] CloseHandle (hObject=0x100) returned 1 [0265.870] CloseHandle (hObject=0x10c) returned 1 [0265.870] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7461736B73.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7461736b73.xml")) returned 0 [0265.871] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7461736B73.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\7461736b73.xml")) returned 0x20 [0265.871] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tasks.xml", cAlternateFileName="")) returned 0x325058 [0265.871] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0265.871] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0265.871] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0 [0265.871] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20 [0265.871] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0265.872] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0265.872] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.872] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0265.872] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0265.872] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afac, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0265.872] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0265.872] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afac) returned 0x10ab [0265.872] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0265.873] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0265.873] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\776D70.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\776d70.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0265.873] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b9f4 [0265.874] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0265.874] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0265.962] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1b9f4, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x1b9f4, lpOverlapped=0x0) returned 1 [0265.966] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1ba00, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x1ba00, lpOverlapped=0x0) returned 1 [0265.968] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.990] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.001] CloseHandle (hObject=0x10c) returned 1 [0266.001] CloseHandle (hObject=0x100) returned 1 [0266.001] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\776D70.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\776d70.ico")) returned 0 [0266.001] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\776D70.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\776d70.ico")) returned 0x20 [0266.001] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="wmp.ico", cAlternateFileName="")) returned 0x325058 [0266.001] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0266.002] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0266.002] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0 [0266.002] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0x20 [0266.002] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0266.002] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0266.002] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676f6f, dwReserved1=0x62643262, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0266.002] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName=".", cAlternateFileName="")) returned 0x325018 [0266.005] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="..", cAlternateFileName="")) returned 1 [0266.005] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="en-US", cAlternateFileName="")) returned 1 [0266.005] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x325058 [0266.006] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0266.006] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0xbc00ba, dwReserved1=0x31c7b8, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0266.006] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0266.006] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.006] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0266.006] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0266.007] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0266.007] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.007] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0a4) returned 0x10ab [0266.007] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0266.007] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0266.008] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\7265736f75726365.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0266.009] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e8 [0266.009] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0266.009] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0266.104] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5e8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x5e8, lpOverlapped=0x0) returned 1 [0266.105] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x5f0, lpOverlapped=0x0) returned 1 [0266.106] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.129] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.139] CloseHandle (hObject=0x10c) returned 1 [0266.139] CloseHandle (hObject=0x104) returned 1 [0266.140] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\7265736f75726365.xml")) returned 0 [0266.140] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\7265736F75726365.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\7265736f75726365.xml")) returned 0x20 [0266.140] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="resource.xml", cAlternateFileName="")) returned 0x325098 [0266.140] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0266.140] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0266.140] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0 [0266.140] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20 [0266.140] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0xbc00ba, dwReserved1=0x31c7b8, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0266.140] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0266.140] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x7735386c, dwReserved1=0x7758b613, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0266.141] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0266.141] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.141] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0266.141] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0266.142] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0266.142] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.142] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0266.142] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0266.142] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0266.142] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\666F6C646572.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\666f6c646572.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0266.143] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0266.143] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0266.143] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0266.224] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xd0a3, lpOverlapped=0x0) returned 1 [0266.227] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xd0b0, lpOverlapped=0x0) returned 1 [0266.229] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.251] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.262] CloseHandle (hObject=0x100) returned 1 [0266.262] CloseHandle (hObject=0x104) returned 1 [0266.262] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\666F6C646572.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\666f6c646572.ico")) returned 0 [0266.263] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\666F6C646572.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\666f6c646572.ico")) returned 0x20 [0266.263] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="folder.ico", cAlternateFileName="")) returned 0x325058 [0266.263] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0266.263] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0266.263] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0 [0266.263] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0x20 [0266.263] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0266.264] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0266.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0266.264] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0266.264] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b070, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0266.264] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.264] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b070) returned 0x10ab [0266.265] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0266.265] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0266.265] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F70726566.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f70726566.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0266.266] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3c8 [0266.266] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0266.266] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0266.359] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xe3c8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xe3c8, lpOverlapped=0x0) returned 1 [0266.362] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe3d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xe3d0, lpOverlapped=0x0) returned 1 [0266.364] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.392] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.402] CloseHandle (hObject=0x104) returned 1 [0266.403] CloseHandle (hObject=0x100) returned 1 [0266.403] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F70726566.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f70726566.ico")) returned 0 [0266.403] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F70726566.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f70726566.ico")) returned 0x20 [0266.403] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="print_pref.ico", cAlternateFileName="")) returned 0x325058 [0266.403] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="print_pref.ico", cAlternateFileName="")) returned 0 [0266.403] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0266.403] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0 [0266.403] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0x20 [0266.403] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0266.404] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0266.404] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.404] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0266.404] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0266.404] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b070, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0266.404] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.404] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b070) returned 0x10ab [0266.404] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0266.405] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0266.405] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F70726F7065727479.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f70726f7065727479.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0266.405] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xebb8 [0266.405] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0266.406] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0266.476] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xebb8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xebb8, lpOverlapped=0x0) returned 1 [0266.479] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xebc0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xebc0, lpOverlapped=0x0) returned 1 [0266.484] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.506] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.517] CloseHandle (hObject=0x100) returned 1 [0266.517] CloseHandle (hObject=0x104) returned 1 [0266.517] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F70726F7065727479.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f70726f7065727479.ico")) returned 0 [0266.517] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F70726F7065727479.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f70726f7065727479.ico")) returned 0x20 [0266.517] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="print_property.ico", cAlternateFileName="")) returned 0x325058 [0266.517] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="print_property.ico", cAlternateFileName="")) returned 0 [0266.517] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0266.517] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0 [0266.517] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0x20 [0266.517] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0266.518] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0266.519] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.519] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0266.519] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0266.519] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0266.519] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.519] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0266.519] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0266.519] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0266.520] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F7175657565.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f7175657565.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0266.521] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff5 [0266.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0266.521] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0266.606] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0xdff5, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xdff5, lpOverlapped=0x0) returned 1 [0266.609] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xe000, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xe000, lpOverlapped=0x0) returned 1 [0266.611] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.633] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.644] CloseHandle (hObject=0x104) returned 1 [0266.644] CloseHandle (hObject=0x100) returned 1 [0266.644] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F7175657565.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f7175657565.ico")) returned 0 [0266.644] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696E745F7175657565.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7072696e745f7175657565.ico")) returned 0x20 [0266.644] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="print_queue.ico", cAlternateFileName="")) returned 0x325058 [0266.644] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="print_queue.ico", cAlternateFileName="")) returned 0 [0266.644] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0266.645] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0 [0266.645] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0x20 [0266.645] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0266.645] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0266.645] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.645] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0266.645] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0266.646] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b080, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0266.646] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.646] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b080) returned 0x10ab [0266.646] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0266.646] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0266.646] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0266.647] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec75 [0266.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0266.647] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0266.732] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xec75, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xec75, lpOverlapped=0x0) returned 1 [0266.735] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xec80, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xec80, lpOverlapped=0x0) returned 1 [0266.737] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.759] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.772] CloseHandle (hObject=0x100) returned 1 [0266.772] CloseHandle (hObject=0x104) returned 1 [0266.772] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f.ico")) returned 0 [0266.772] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f.ico")) returned 0x20 [0266.773] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="scan_.ico", cAlternateFileName="")) returned 0x325058 [0266.773] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="scan_.ico", cAlternateFileName="")) returned 0 [0266.773] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0266.773] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0 [0266.773] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0x20 [0266.773] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0266.774] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0266.774] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.774] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0266.774] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0266.774] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b0b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0266.774] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.774] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b0b0) returned 0x10ab [0266.774] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0266.774] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0266.775] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F70726F7065727479.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f70726f7065727479.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0266.775] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10654 [0266.775] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0266.776] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0266.860] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x10654, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x10654, lpOverlapped=0x0) returned 1 [0266.863] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x10660, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x10660, lpOverlapped=0x0) returned 1 [0266.865] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.887] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.898] CloseHandle (hObject=0x104) returned 1 [0266.898] CloseHandle (hObject=0x100) returned 1 [0266.898] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F70726F7065727479.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f70726f7065727479.ico")) returned 0 [0266.898] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F70726F7065727479.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f70726f7065727479.ico")) returned 0x20 [0266.898] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="scan_property.ico", cAlternateFileName="")) returned 0x325058 [0266.898] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="scan_property.ico", cAlternateFileName="")) returned 0 [0266.898] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0266.898] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0 [0266.899] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0x20 [0266.899] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0266.899] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0266.899] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.899] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0266.899] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0266.899] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b008, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0266.899] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0266.900] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b008) returned 0x10ab [0266.900] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0266.900] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0266.900] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F73657474696E6773.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f73657474696e6773.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0266.901] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8c2 [0266.901] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0266.901] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0266.972] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xf8c2, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0xf8c2, lpOverlapped=0x0) returned 1 [0266.975] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xf8d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0xf8d0, lpOverlapped=0x0) returned 1 [0266.977] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.999] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.010] CloseHandle (hObject=0x100) returned 1 [0267.010] CloseHandle (hObject=0x104) returned 1 [0267.010] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F73657474696E6773.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f73657474696e6773.ico")) returned 0 [0267.010] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616E5F73657474696E6773.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7363616e5f73657474696e6773.ico")) returned 0x20 [0267.010] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 0x325058 [0267.010] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 0 [0267.010] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0267.010] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0 [0267.011] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0x20 [0267.011] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0267.011] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0267.011] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.011] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0267.011] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0267.011] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b064, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0267.011] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.012] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b064) returned 0x10ab [0267.012] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0267.012] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0267.012] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7461736B73.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7461736b73.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0267.013] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c64 [0267.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0267.013] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0267.106] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18edd0*=0x2c64, lpOverlapped=0x0) returned 1 [0267.108] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2c70, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18edd0*=0x2c70, lpOverlapped=0x0) returned 1 [0267.109] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.131] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.141] CloseHandle (hObject=0x104) returned 1 [0267.142] CloseHandle (hObject=0x100) returned 1 [0267.142] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7461736B73.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7461736b73.xml")) returned 0 [0267.142] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7461736B73.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\7461736b73.xml")) returned 0x20 [0267.142] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tasks.xml", cAlternateFileName="")) returned 0x325058 [0267.143] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0267.143] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0267.143] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0 [0267.143] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20 [0267.143] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x7735387a, dwReserved1=0x7758b613, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0267.143] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0267.143] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676f6f, dwReserved1=0x62643262, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0267.143] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.143] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 0 [0267.143] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.143] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0267.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.144] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0267.144] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 0 [0267.144] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.144] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="DRM", cAlternateFileName="")) returned 1 [0267.144] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.145] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0267.145] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Server", cAlternateFileName="")) returned 1 [0267.145] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0267.145] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0267.145] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0267.145] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.145] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Server", cAlternateFileName="")) returned 0 [0267.145] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.145] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="eHome", cAlternateFileName="")) returned 1 [0267.145] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.145] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0267.145] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="logs", cAlternateFileName="")) returned 1 [0267.145] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0267.146] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0267.146] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0267.146] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.146] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="logs", cAlternateFileName="")) returned 0 [0267.146] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.146] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0267.146] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.146] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0267.146] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Views", cAlternateFileName="")) returned 1 [0267.146] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0267.147] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0267.147] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0267.147] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0267.147] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.147] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0267.147] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0267.147] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0267.147] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.147] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Views", cAlternateFileName="")) returned 0 [0267.147] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.147] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18302e, dwReserved1=0x18f45c, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0267.147] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.148] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0267.148] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0267.148] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0267.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0267.149] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29d78, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0267.149] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.149] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29d78) returned 0x10ab [0267.149] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0267.149] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\707063726C636F6E666967.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\707063726c636f6e666967.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0267.155] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d00 [0267.155] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0267.155] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0267.241] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3d00, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x3d00, lpOverlapped=0x0) returned 1 [0267.243] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3d10, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x3d10, lpOverlapped=0x0) returned 1 [0267.244] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.266] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.277] CloseHandle (hObject=0xf0) returned 1 [0267.277] CloseHandle (hObject=0xfc) returned 1 [0267.277] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\707063726C636F6E666967.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\707063726c636f6e666967.dll")) returned 0 [0267.278] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\707063726C636F6E666967.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\707063726c636f6e666967.dll")) returned 0x20 [0267.278] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0x324fd8 [0267.278] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0267.278] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.278] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll")) returned 1 [0267.279] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll")) returned 0xffffffff [0267.279] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0267.280] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0267.280] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.280] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0267.280] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29fa8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0267.280] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.280] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29fa8) returned 0x10ab [0267.280] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0267.283] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\707063726C7569.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\707063726c7569.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0267.284] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e108 [0267.284] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0267.284] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0267.375] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x3e108, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x3e108, lpOverlapped=0x0) returned 1 [0267.419] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x3e110, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x3e110, lpOverlapped=0x0) returned 1 [0267.426] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.448] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.459] CloseHandle (hObject=0xfc) returned 1 [0267.459] CloseHandle (hObject=0xf0) returned 1 [0267.460] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\707063726C7569.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\707063726c7569.dll")) returned 0 [0267.461] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\707063726C7569.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\707063726c7569.dll")) returned 0x20 [0267.461] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0x324fd8 [0267.462] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0267.462] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.462] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll")) returned 1 [0267.464] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll")) returned 0xffffffff [0267.464] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0267.464] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.464] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x18f45c, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0267.464] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.465] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="..", cAlternateFileName="")) returned 1 [0267.465] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="..", cAlternateFileName="")) returned 0 [0267.465] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.465] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x18f45c, cFileName="MF", cAlternateFileName="")) returned 1 [0267.465] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.465] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="..", cAlternateFileName="")) returned 1 [0267.465] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0267.466] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0267.466] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.466] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0267.466] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0267.467] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.467] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2b0) returned 0x10ab [0267.467] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0267.467] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0267.467] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.467] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0267.467] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a338, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0267.467] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.467] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a338) returned 0x10ab [0267.467] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0267.467] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.467] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x18f45c, cFileName="MSDN", cAlternateFileName="")) returned 1 [0267.467] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.468] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="..", cAlternateFileName="")) returned 1 [0267.468] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="8.0", cAlternateFileName="")) returned 1 [0267.468] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0267.468] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 1 [0267.468] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 0 [0267.468] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.468] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="8.0", cAlternateFileName="")) returned 0 [0267.468] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.468] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x18f45c, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0267.468] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.473] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="..", cAlternateFileName="")) returned 1 [0267.473] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0267.473] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0267.473] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 1 [0267.473] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 0 [0267.474] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.474] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0267.474] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0267.474] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x18f45c, cFileName="Network", cAlternateFileName="")) returned 1 [0267.474] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0267.474] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="..", cAlternateFileName="")) returned 1 [0267.474] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0267.474] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0267.474] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 1 [0267.474] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 0 [0267.474] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0267.474] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0267.474] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0267.475] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="..", cAlternateFileName="")) returned 1 [0267.475] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x18f0dc, dwReserved1=0x18f0dc, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1 [0267.475] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0267.475] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.475] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0267.475] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a684, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0267.475] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.475] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a684) returned 0x10ab [0267.475] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0267.476] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\716D677230.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\716d677230.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0267.476] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x400000 [0267.476] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0267.476] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0267.510] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x400000, lpOverlapped=0x0) returned 1 [0267.647] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x400010, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x400010, lpOverlapped=0x0) returned 1 [0267.725] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.747] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.758] CloseHandle (hObject=0xfc) returned 1 [0267.758] CloseHandle (hObject=0x100) returned 1 [0267.758] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\716D677230.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\716d677230.dat")) returned 0 [0267.759] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\716D677230.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\716d677230.dat")) returned 0x20 [0267.759] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qmgr0.dat", cAlternateFileName="")) returned 0x325018 [0267.759] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="qmgr0.dat", cAlternateFileName="")) returned 0 [0267.759] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0267.759] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 1 [0267.767] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0xffffffff [0267.767] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1 [0267.768] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0267.768] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.768] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0267.769] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291f8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0267.769] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0267.769] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291f8) returned 0x10ab [0267.769] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0267.769] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\716D677231.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\716d677231.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0267.769] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x400000 [0267.769] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0267.770] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0267.853] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x400000, lpOverlapped=0x0) returned 1 [0267.973] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x400010, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x400010, lpOverlapped=0x0) returned 1 [0268.066] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.097] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.108] CloseHandle (hObject=0x100) returned 1 [0268.108] CloseHandle (hObject=0xfc) returned 1 [0268.108] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\716D677231.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\716d677231.dat")) returned 0 [0268.109] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\716D677231.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\716d677231.dat")) returned 0x20 [0268.109] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0x325018 [0268.109] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0268.109] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0268.109] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat")) returned 1 [0268.117] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat")) returned 0xffffffff [0268.118] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0268.118] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0268.118] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0268.118] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0268.118] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x18f45c, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0268.118] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0268.120] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="..", cAlternateFileName="")) returned 1 [0268.120] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x18f1d8, dwReserved1=0x18f1f4, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0268.121] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.121] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29570, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.121] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.121] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29570) returned 0x10ab [0268.121] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0268.123] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\41737365744C696272617279.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\41737365744c696272617279.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0268.123] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1536 [0268.123] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0268.123] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0268.196] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x1536, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x1536, lpOverlapped=0x0) returned 1 [0268.198] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x1540, lpOverlapped=0x0) returned 1 [0268.199] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.221] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.232] CloseHandle (hObject=0xf0) returned 1 [0268.232] CloseHandle (hObject=0xfc) returned 1 [0268.232] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\41737365744C696272617279.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\41737365744c696272617279.ico")) returned 0 [0268.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\41737365744C696272617279.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\41737365744c696272617279.ico")) returned 0x2020 [0268.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 0x324fd8 [0268.233] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 0 [0268.233] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0268.233] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico")) returned 1 [0268.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico")) returned 0xffffffff [0268.234] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0268.235] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.235] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.235] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.235] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a80c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.235] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.235] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a80c) returned 0x10ab [0268.235] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0268.236] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\446F63756D656E745265706F7369746F7279.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\446f63756d656e745265706f7369746f7279.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0268.237] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x627e [0268.237] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0268.237] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0268.322] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x627e, lpOverlapped=0x0) returned 1 [0268.334] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6280, lpOverlapped=0x0) returned 1 [0268.336] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.367] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.391] CloseHandle (hObject=0xfc) returned 1 [0268.391] CloseHandle (hObject=0xf0) returned 1 [0268.391] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\446F63756D656E745265706F7369746F7279.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\446f63756d656e745265706f7369746f7279.ico")) returned 0 [0268.392] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\446F63756D656E745265706F7369746F7279.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\446f63756d656e745265706f7369746f7279.ico")) returned 0x2020 [0268.392] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 0x324fd8 [0268.392] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 0 [0268.392] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0268.393] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico")) returned 1 [0268.393] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico")) returned 0xffffffff [0268.394] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0268.394] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.394] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.395] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.395] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.395] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.395] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa50) returned 0x10ab [0268.395] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0268.396] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\4D795368617265506F696E7473.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\4d795368617265506f696e7473.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0268.396] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5532e [0268.396] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0268.397] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0268.480] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x5532e, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x5532e, lpOverlapped=0x0) returned 1 [0268.491] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x55330, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x55330, lpOverlapped=0x0) returned 1 [0268.498] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.521] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.532] CloseHandle (hObject=0xf0) returned 1 [0268.532] CloseHandle (hObject=0xfc) returned 1 [0268.532] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\4D795368617265506F696E7473.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\4d795368617265506f696e7473.ico")) returned 0 [0268.532] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\4D795368617265506F696E7473.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\4d795368617265506f696e7473.ico")) returned 0x2020 [0268.532] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 0x324fd8 [0268.533] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 0 [0268.533] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0268.533] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico")) returned 1 [0268.536] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico")) returned 0xffffffff [0268.536] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0268.537] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.537] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.537] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.537] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa50, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.537] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.537] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa50) returned 0x10ab [0268.537] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0268.538] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\4D7953697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\4d7953697465.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0268.538] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x627e [0268.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0268.539] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0268.627] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x627e, lpOverlapped=0x0) returned 1 [0268.629] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6280, lpOverlapped=0x0) returned 1 [0268.631] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.653] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.663] CloseHandle (hObject=0xfc) returned 1 [0268.663] CloseHandle (hObject=0xf0) returned 1 [0268.663] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\4D7953697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\4d7953697465.ico")) returned 0 [0268.664] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\4D7953697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\4d7953697465.ico")) returned 0x2020 [0268.664] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MySite.ico", cAlternateFileName="")) returned 0x324fd8 [0268.664] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MySite.ico", cAlternateFileName="")) returned 0 [0268.664] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0268.664] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico")) returned 1 [0268.665] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico")) returned 0xffffffff [0268.665] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0268.666] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.666] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.666] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.666] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac6c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.666] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.666] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac6c) returned 0x10ab [0268.666] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0268.669] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\5368617265506F696E74506F7274616C53697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\5368617265506f696e74506f7274616c53697465.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0268.670] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x627e [0268.670] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0268.670] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0268.756] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x627e, lpOverlapped=0x0) returned 1 [0268.758] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6280, lpOverlapped=0x0) returned 1 [0268.759] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.783] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.793] CloseHandle (hObject=0xf0) returned 1 [0268.793] CloseHandle (hObject=0xfc) returned 1 [0268.794] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\5368617265506F696E74506F7274616C53697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\5368617265506f696e74506f7274616c53697465.ico")) returned 0 [0268.794] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\5368617265506F696E74506F7274616C53697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\5368617265506f696e74506f7274616c53697465.ico")) returned 0x2020 [0268.794] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 0x324fd8 [0268.794] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 0 [0268.794] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0268.794] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico")) returned 1 [0268.795] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico")) returned 0xffffffff [0268.796] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0268.797] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.797] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.797] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.797] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acf8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.797] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.797] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acf8) returned 0x10ab [0268.797] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0268.798] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\5368617265506F696E745465616D53697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\5368617265506f696e745465616d53697465.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0268.799] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x627e [0268.799] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0268.799] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0268.886] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x627e, lpOverlapped=0x0) returned 1 [0268.888] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6280, lpOverlapped=0x0) returned 1 [0268.890] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.911] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.923] CloseHandle (hObject=0xfc) returned 1 [0268.923] CloseHandle (hObject=0xf0) returned 1 [0268.923] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\5368617265506F696E745465616D53697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\5368617265506f696e745465616d53697465.ico")) returned 0 [0268.924] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\5368617265506F696E745465616D53697465.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\5368617265506f696e745465616d53697465.ico")) returned 0x2020 [0268.924] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 0x324fd8 [0268.924] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 0 [0268.924] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0268.924] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico")) returned 1 [0268.925] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico")) returned 0xffffffff [0268.925] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0268.925] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x760074, dwReserved1=0x30f830, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0268.926] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x760074, dwReserved1=0x30f830, cFileName="..", cAlternateFileName="")) returned 1 [0268.926] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x760074, dwReserved1=0x30f830, cFileName="1036", cAlternateFileName="")) returned 1 [0268.926] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006f, dwReserved1=0x31006f, cFileName=".", cAlternateFileName="")) returned 0x325018 [0268.928] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006f, dwReserved1=0x31006f, cFileName="..", cAlternateFileName="")) returned 1 [0268.929] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x63006f, dwReserved1=0x31006f, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0268.929] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.929] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.929] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.929] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2967c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.929] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.929] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2967c) returned 0x10ab [0268.930] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0268.930] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.930] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.930] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.930] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.930] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.930] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af44) returned 0x10ab [0268.930] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0268.931] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.931] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.931] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.931] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0268.931] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.931] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.931] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af74) returned 0x10ab [0268.931] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0268.931] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0268.932] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.932] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.932] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.932] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.932] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.932] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.932] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0268.932] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.932] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.932] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.932] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.932] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.932] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.933] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0268.933] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.933] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.933] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.933] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29554, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.933] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.933] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29554) returned 0x10ab [0268.933] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0268.934] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.934] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.934] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.934] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.934] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.934] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.934] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0268.934] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.934] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.934] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.934] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29554, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.934] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.934] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29554) returned 0x10ab [0268.934] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0268.935] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.935] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.935] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.935] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.935] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.935] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.935] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0268.935] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.935] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.936] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.936] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29534, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.936] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.936] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29534) returned 0x10ab [0268.936] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0268.936] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.936] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.936] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.936] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.936] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.936] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.936] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0268.937] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.937] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.937] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.937] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.937] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.937] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295b0) returned 0x10ab [0268.937] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0268.937] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.937] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.937] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.938] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.938] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.938] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.938] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0268.938] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.938] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.938] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.938] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.938] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.938] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.938] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0268.939] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.939] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.939] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.939] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29534, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.939] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.939] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29534) returned 0x10ab [0268.939] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0268.939] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.939] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.939] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.939] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.939] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.939] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.940] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0268.940] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.940] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.940] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.940] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.940] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.940] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295b0) returned 0x10ab [0268.940] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0268.941] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.941] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.941] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.941] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.941] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.941] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.941] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0268.941] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.941] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.941] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.941] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29554, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.941] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.941] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29554) returned 0x10ab [0268.941] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0268.942] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.942] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.942] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.942] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.942] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.942] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.942] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0268.942] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.942] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.942] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.943] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295b0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.943] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.943] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295b0) returned 0x10ab [0268.943] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0268.943] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.943] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.943] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.943] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.943] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.943] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.943] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0268.944] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.944] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.944] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0268.944] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.944] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29574, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29574) returned 0x10ab [0268.945] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0268.945] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.945] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.945] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.945] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29538, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.945] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.945] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29538) returned 0x10ab [0268.945] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0268.946] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.946] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.946] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.946] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295d4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.946] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.946] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295d4) returned 0x10ab [0268.946] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0268.946] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.946] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.947] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.947] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29514, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.947] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.947] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29514) returned 0x10ab [0268.947] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0268.947] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0268.947] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="3082", cAlternateFileName="")) returned 1 [0268.948] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName=".", cAlternateFileName="")) returned 0x325018 [0268.949] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="..", cAlternateFileName="")) returned 1 [0268.950] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0268.950] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.950] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c296a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c296a4) returned 0x10ab [0268.951] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0268.951] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.951] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2956c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2956c) returned 0x10ab [0268.951] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0268.952] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.952] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.952] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.952] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2962c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.952] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.952] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2962c) returned 0x10ab [0268.952] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0268.953] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.953] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.953] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.953] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2956c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.953] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.953] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2956c) returned 0x10ab [0268.953] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0268.953] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.953] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.953] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.953] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295fc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.953] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.953] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295fc) returned 0x10ab [0268.953] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0268.954] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.954] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.954] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.954] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.954] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.954] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295a4) returned 0x10ab [0268.954] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0268.954] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.954] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.954] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.955] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2962c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.955] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.955] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2962c) returned 0x10ab [0268.955] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0268.955] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.955] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.955] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.955] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2967c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.955] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.955] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2967c) returned 0x10ab [0268.955] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0268.956] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.956] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2969c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2969c) returned 0x10ab [0268.956] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0268.956] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.956] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29734, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29734) returned 0x10ab [0268.957] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0268.957] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.957] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.957] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.957] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29584, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.957] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.957] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29584) returned 0x10ab [0268.957] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0268.958] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.958] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.958] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.958] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29644, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.958] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.958] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29644) returned 0x10ab [0268.958] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0268.958] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.958] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.958] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.958] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29584, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.958] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.958] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29584) returned 0x10ab [0268.958] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0268.959] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.959] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.959] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.959] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29584, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.959] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.959] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29584) returned 0x10ab [0268.959] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0268.959] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.959] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.959] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.960] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.960] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.960] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295e4) returned 0x10ab [0268.960] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0268.960] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.960] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.960] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.960] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295a8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.960] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.960] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295a8) returned 0x10ab [0268.960] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0268.961] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.961] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29638, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29638) returned 0x10ab [0268.961] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0268.961] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.961] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29584, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29584) returned 0x10ab [0268.962] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0268.962] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.962] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.962] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.962] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.962] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.962] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295e4) returned 0x10ab [0268.962] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0268.963] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.963] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c295a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c295a4) returned 0x10ab [0268.963] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0268.963] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.963] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29638, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.963] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.963] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29638) returned 0x10ab [0268.963] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0268.964] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.964] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2959c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.964] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2959c) returned 0x10ab [0268.964] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0268.964] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.964] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.965] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2959c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2959c) returned 0x10ab [0268.965] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0268.965] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.965] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.965] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.965] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af44) returned 0x10ab [0268.965] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0268.966] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.966] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.966] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.966] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c296f0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.966] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.966] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c296f0) returned 0x10ab [0268.966] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0268.966] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.966] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.966] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.966] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.966] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.966] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af44) returned 0x10ab [0268.967] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0268.967] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.967] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.967] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.967] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0268.967] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.967] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.968] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0268.968] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0268.968] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x18ed08, dwReserved1=0x18ed24, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0268.968] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0268.969] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="3082", cAlternateFileName="")) returned 0 [0268.969] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0268.969] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0268.969] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0268.969] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x536d6165, dwReserved1=0x2e657469, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0268.969] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0268.969] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.969] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0268.969] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0268.969] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="..", cAlternateFileName="")) returned 1 [0268.969] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="cache.dat", cAlternateFileName="")) returned 1 [0268.970] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0268.970] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.970] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0268.970] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29624, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0268.970] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0268.970] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29624) returned 0x10ab [0268.970] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0268.970] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\6361636865.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\6361636865.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0268.971] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40270 [0268.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0268.971] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0269.042] ReadFile (in: hFile=0xfc, lpBuffer=0x280000c, nNumberOfBytesToRead=0x40270, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x40270, lpOverlapped=0x0) returned 1 [0269.051] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x40280, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x40280, lpOverlapped=0x0) returned 1 [0269.056] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.079] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.089] CloseHandle (hObject=0xfc) returned 1 [0269.089] CloseHandle (hObject=0x100) returned 1 [0269.089] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\6361636865.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\6361636865.dat")) returned 0 [0269.090] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\6361636865.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\6361636865.dat")) returned 0x2020 [0269.090] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cache.dat", cAlternateFileName="")) returned 0x325018 [0269.090] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="cache.dat", cAlternateFileName="")) returned 0 [0269.090] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.090] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat")) returned 1 [0269.101] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat")) returned 0xffffffff [0269.101] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="cache.dat", cAlternateFileName="")) returned 0 [0269.101] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0269.101] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0269.102] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.102] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c299a4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.102] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.102] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c299a4) returned 0x10ab [0269.102] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0269.102] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\746F6B656E73.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\746f6b656e73.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0269.103] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x469bd5 [0269.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0269.103] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0269.190] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x469bd5, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f2a0*=0x469bd5, lpOverlapped=0x0) returned 1 [0269.321] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x469be0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f2a0*=0x469be0, lpOverlapped=0x0) returned 1 [0269.442] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.463] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.474] CloseHandle (hObject=0xf0) returned 1 [0269.474] CloseHandle (hObject=0x100) returned 1 [0269.475] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\746F6B656E73.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\746f6b656e73.dat")) returned 0 [0269.475] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\746F6B656E73.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\746f6b656e73.dat")) returned 0x2020 [0269.475] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tokens.dat", cAlternateFileName="")) returned 0x324fd8 [0269.476] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0269.476] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0269.476] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat")) returned 1 [0269.480] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat")) returned 0xffffffff [0269.480] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0269.480] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0269.480] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x536d6165, dwReserved1=0x2e657469, cFileName="RAC", cAlternateFileName="")) returned 1 [0269.480] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0269.480] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="..", cAlternateFileName="")) returned 1 [0269.480] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Outbound", cAlternateFileName="")) returned 1 [0269.480] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0269.481] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0269.481] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 0 [0269.481] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0269.481] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7b503bb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x7b503bb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0269.481] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7b503bb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x7b503bb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0269.481] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7b503bb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x7b503bb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0269.481] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7b503bb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x8cf11a70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x45000, dwReserved0=0x920090, dwReserved1=0x31c7b8, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1 [0269.482] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.482] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.483] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.483] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29cd8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.483] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.483] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29cd8) returned 0x10ab [0269.483] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.483] CloseHandle (hObject=0xffffffff) returned 0 [0269.483] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\526163576D694461746162617365.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\526163576d694461746162617365.sdf")) returned 0 [0269.483] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\526163576D694461746162617365.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\526163576d694461746162617365.sdf")) returned 0xffffffff [0269.483] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7b503bb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x8cf11a70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x45000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0x325018 [0269.483] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7b503bb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x8cf11a70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x45000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0269.483] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.483] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 0 [0269.484] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 0x2020 [0269.484] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7b503bb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x8cf11a70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x45000, dwReserved0=0x920090, dwReserved1=0x31c7b8, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0269.484] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0269.484] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c2926f0, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8c2926f0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657361, dwReserved1=0x77666473, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0269.484] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c2926f0, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8c2926f0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0269.484] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c2926f0, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8c2926f0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="..", cAlternateFileName="")) returned 1 [0269.484] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8cfd0150, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1 [0269.484] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.484] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.484] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.484] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a090, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.484] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.485] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a090) returned 0x10ab [0269.485] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.485] CloseHandle (hObject=0xffffffff) returned 0 [0269.485] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\5261634461746162617365.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\5261634461746162617365.sdf")) returned 0 [0269.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\5261634461746162617365.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\5261634461746162617365.sdf")) returned 0xffffffff [0269.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8cfd0150, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 0x325018 [0269.485] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8cfd0150, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 0 [0269.485] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.485] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0 [0269.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0x2020 [0269.485] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0x96554730, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1 [0269.486] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.486] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a318, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.486] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.486] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a318) returned 0x10ab [0269.486] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.486] CloseHandle (hObject=0xffffffff) returned 0 [0269.486] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\5261634D65746144617461.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\5261634d65746144617461.dat")) returned 0 [0269.486] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\5261634D65746144617461.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\5261634d65746144617461.dat")) returned 0xffffffff [0269.486] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0x96554730, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0x325018 [0269.486] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0x96554730, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0 [0269.486] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.487] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat")) returned 0 [0269.487] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat")) returned 0x2020 [0269.487] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c2926f0, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x8c2926f0, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8c8d20b0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x401c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDataBookmarks.dat", cAlternateFileName="RACWMI~2.DAT")) returned 1 [0269.487] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.487] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.487] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.487] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a5e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.487] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.487] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a5e4) returned 0x10ab [0269.487] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0269.487] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\526163576D6944617461426F6F6B6D61726B73.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\526163576d6944617461426f6f6b6d61726b73.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0269.488] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401c [0269.488] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0269.489] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0269.563] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0x401c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0x401c, lpOverlapped=0x0) returned 1 [0269.564] WriteFile (in: hFile=0xfc, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0x4020, lpOverlapped=0x0) returned 1 [0269.565] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.588] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.614] CloseHandle (hObject=0xf0) returned 1 [0269.614] CloseHandle (hObject=0xfc) returned 1 [0269.614] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\526163576D6944617461426F6F6B6D61726B73.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\526163576d6944617461426f6f6b6d61726b73.dat")) returned 0 [0269.615] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\526163576D6944617461426F6F6B6D61726B73.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\526163576d6944617461426f6f6b6d61726b73.dat")) returned 0x2020 [0269.615] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c2926f0, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x8c2926f0, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8c8d20b0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x401c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="RacWmiDataBookmarks.dat", cAlternateFileName="RACWMI~2.DAT")) returned 0x325018 [0269.615] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c2926f0, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x8c2926f0, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8c8d20b0, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x401c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="RacWmiDataBookmarks.dat", cAlternateFileName="RACWMI~2.DAT")) returned 0 [0269.615] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.615] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat")) returned 1 [0269.616] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat")) returned 0xffffffff [0269.616] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8beb4330, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x8beb4330, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8beda490, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x801c, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="RacWmiEventData.dat", cAlternateFileName="RACWMI~1.DAT")) returned 1 [0269.617] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.617] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.617] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.617] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a994, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.617] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.617] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a994) returned 0x10ab [0269.617] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmieventdata.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.617] CloseHandle (hObject=0xffffffff) returned 0 [0269.617] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmieventdata.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\526163576D694576656E7444617461.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\526163576d694576656e7444617461.dat")) returned 0 [0269.617] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\526163576D694576656E7444617461.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\526163576d694576656e7444617461.dat")) returned 0xffffffff [0269.617] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8beb4330, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x8beb4330, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8beda490, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x801c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="RacWmiEventData.dat", cAlternateFileName="RACWMI~1.DAT")) returned 0x325018 [0269.617] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8beb4330, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x8beb4330, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8beda490, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x801c, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="RacWmiEventData.dat", cAlternateFileName="RACWMI~1.DAT")) returned 0 [0269.617] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.617] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmieventdata.dat")) returned 0 [0269.617] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmieventdata.dat")) returned 0x2020 [0269.618] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8beb4330, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0x8beb4330, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0x8beda490, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x801c, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="RacWmiEventData.dat", cAlternateFileName="RACWMI~1.DAT")) returned 0 [0269.618] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0269.618] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd1f8fa70, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f8fa70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746144, dwReserved1=0x7461642e, cFileName="Temp", cAlternateFileName="")) returned 1 [0269.618] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd1f8fa70, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f8fa70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0269.618] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd1f8fa70, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f8fa70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="..", cAlternateFileName="")) returned 1 [0269.618] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f69910, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0xd1f69910, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f69910, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="sql337E.tmp", cAlternateFileName="")) returned 1 [0269.618] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.618] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.618] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.618] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2accc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.618] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.618] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2accc) returned 0x10ab [0269.619] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql337E.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql337e.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.619] CloseHandle (hObject=0xffffffff) returned 0 [0269.619] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql337E.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql337e.tmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\73716C33333745.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\73716c33333745.tmp")) returned 0 [0269.619] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\73716C33333745.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\73716c33333745.tmp")) returned 0xffffffff [0269.619] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql337E.tmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f69910, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0xd1f69910, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f69910, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sql337E.tmp", cAlternateFileName="")) returned 0x325018 [0269.619] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f69910, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0xd1f69910, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f69910, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sql337E.tmp", cAlternateFileName="")) returned 0 [0269.619] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.619] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql337E.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql337e.tmp")) returned 0 [0269.619] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql337E.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql337e.tmp")) returned 0x2020 [0269.619] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f8fa70, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0xd1f8fa70, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f8fa70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="sql338E.tmp", cAlternateFileName="")) returned 1 [0269.620] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.620] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.620] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.620] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2af00, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.620] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.620] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2af00) returned 0x10ab [0269.620] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql338E.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql338e.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.620] CloseHandle (hObject=0xffffffff) returned 0 [0269.620] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql338E.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql338e.tmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\73716C33333845.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\73716c33333845.tmp")) returned 0 [0269.620] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\73716C33333845.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\73716c33333845.tmp")) returned 0xffffffff [0269.620] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql338E.tmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f8fa70, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0xd1f8fa70, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f8fa70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sql338E.tmp", cAlternateFileName="")) returned 0x325018 [0269.620] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f8fa70, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0xd1f8fa70, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f8fa70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="sql338E.tmp", cAlternateFileName="")) returned 0 [0269.620] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.620] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql338E.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql338e.tmp")) returned 0 [0269.621] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql338E.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql338e.tmp")) returned 0x2020 [0269.621] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f8fa70, ftCreationTime.dwHighDateTime=0x1d68328, ftLastAccessTime.dwLowDateTime=0xd1f8fa70, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f8fa70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="sql338E.tmp", cAlternateFileName="")) returned 0 [0269.621] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0269.621] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd1f8fa70, ftLastAccessTime.dwHighDateTime=0x1d68328, ftLastWriteTime.dwLowDateTime=0xd1f8fa70, ftLastWriteTime.dwHighDateTime=0x1d68328, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746144, dwReserved1=0x7461642e, cFileName="Temp", cAlternateFileName="")) returned 0 [0269.621] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0269.621] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x536d6174, dwReserved1=0x2e657469, cFileName="Search", cAlternateFileName="")) returned 1 [0269.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746144, dwReserved1=0x7461642e, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0269.621] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746144, dwReserved1=0x7461642e, cFileName="..", cAlternateFileName="")) returned 1 [0269.621] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746144, dwReserved1=0x7461642e, cFileName="Data", cAlternateFileName="")) returned 1 [0269.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0269.621] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="..", cAlternateFileName="")) returned 1 [0269.621] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0269.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0269.622] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.622] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0269.622] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325058 [0269.624] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.624] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1 [0269.624] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325098 [0269.624] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.624] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0269.624] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0269.624] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1 [0269.624] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325098 [0269.625] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.625] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0269.625] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0269.625] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.625] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1 [0269.626] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.626] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.626] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.626] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0269.626] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b02c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.626] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.626] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b02c) returned 0x10ab [0269.626] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0269.627] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1 [0269.627] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.627] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.627] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.627] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0269.627] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b02c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.627] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.627] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b02c) returned 0x10ab [0269.627] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0269.628] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x18e5d0, dwReserved1=0x18e5ec, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0 [0269.628] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0269.628] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0269.628] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0269.628] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.chk", cAlternateFileName="")) returned 1 [0269.628] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.628] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.628] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.628] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29dd8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.628] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.628] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29dd8) returned 0x10ab [0269.628] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0269.630] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\4D5353.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\4d5353.chk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0269.630] GetFileSize (in: hFile=0x104, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0269.630] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0269.631] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0269.716] ReadFile (in: hFile=0x104, lpBuffer=0x280000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x2000, lpOverlapped=0x0) returned 1 [0269.720] WriteFile (in: hFile=0x10c, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x2010, lpOverlapped=0x0) returned 1 [0269.721] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.742] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.753] CloseHandle (hObject=0x104) returned 1 [0269.753] CloseHandle (hObject=0x10c) returned 1 [0269.753] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\4D5353.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\4d5353.chk")) returned 0 [0269.754] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\4D5353.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\4d5353.chk")) returned 0x2020 [0269.754] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MSS.chk", cAlternateFileName="")) returned 0x325098 [0269.754] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="MSS.chk", cAlternateFileName="")) returned 0 [0269.754] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0269.754] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk")) returned 1 [0269.755] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk")) returned 0xffffffff [0269.755] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="MSS.log", cAlternateFileName="")) returned 1 [0269.756] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.756] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.756] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.756] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0269.756] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b018, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.756] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.756] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b018) returned 0x10ab [0269.756] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0269.757] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0269.760] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\4D5353.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\4d5353.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0269.760] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0269.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0269.761] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0269.848] ReadFile (in: hFile=0x10c, lpBuffer=0x280000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0269.872] WriteFile (in: hFile=0x104, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0269.892] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.914] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.926] CloseHandle (hObject=0x10c) returned 1 [0269.926] CloseHandle (hObject=0x104) returned 1 [0269.927] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\4D5353.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\4d5353.log")) returned 0 [0269.927] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\4D5353.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\4d5353.log")) returned 0x2020 [0269.927] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSS.log", cAlternateFileName="")) returned 0x325098 [0269.927] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x332170, dwReserved1=0x308ae0, cFileName="MSS.log", cAlternateFileName="")) returned 0 [0269.927] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0269.927] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log")) returned 1 [0269.938] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log")) returned 0xffffffff [0269.938] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x7735387a, dwReserved1=0x7758b0bb, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1 [0269.938] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.938] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.938] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.939] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a248, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.939] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.939] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a248) returned 0x10ab [0269.939] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1 [0269.939] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.939] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.939] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.939] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a2e4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.939] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.939] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a2e4) returned 0x10ab [0269.939] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Projects", cAlternateFileName="")) returned 1 [0269.939] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName=".", cAlternateFileName="")) returned 0x325098 [0269.940] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="..", cAlternateFileName="")) returned 1 [0269.940] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0269.940] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName=".", cAlternateFileName="")) returned 0x3250d8 [0269.940] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="..", cAlternateFileName="")) returned 1 [0269.941] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="Indexer", cAlternateFileName="")) returned 1 [0269.941] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325118 [0269.941] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.941] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 1 [0269.941] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325158 [0269.943] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.943] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299f0de0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299f0de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.000", cAlternateFileName="")) returned 1 [0269.944] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.944] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a4d8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a4d8) returned 0x10ab [0269.944] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CiAB0001.001", cAlternateFileName="")) returned 1 [0269.944] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.944] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a580, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.944] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.944] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a580) returned 0x10ab [0269.945] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CiAB0001.002", cAlternateFileName="")) returned 1 [0269.945] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.945] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.945] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.945] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a628, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.945] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.945] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a628) returned 0x10ab [0269.945] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CiAB0002.000", cAlternateFileName="")) returned 1 [0269.945] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.946] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.946] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.946] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a6d0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.946] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.946] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a6d0) returned 0x10ab [0269.946] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CiAB0002.001", cAlternateFileName="")) returned 1 [0269.946] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.946] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.946] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.946] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a778, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.946] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.946] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a778) returned 0x10ab [0269.946] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CiAB0002.002", cAlternateFileName="")) returned 1 [0269.947] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.947] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.947] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.947] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a820, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.947] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.947] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a820) returned 0x10ab [0269.947] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299f0de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CiAD0001.000", cAlternateFileName="")) returned 1 [0269.947] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.947] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.947] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.947] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a8c8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.948] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.948] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a8c8) returned 0x10ab [0269.948] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CiAD0001.001", cAlternateFileName="")) returned 1 [0269.948] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.948] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.948] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.948] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a970, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.948] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.948] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a970) returned 0x10ab [0269.948] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="CiAD0001.002", cAlternateFileName="")) returned 1 [0269.949] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.949] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.949] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.949] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa18, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.949] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.949] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa18) returned 0x10ab [0269.949] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="INDEX.000", cAlternateFileName="")) returned 1 [0269.949] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.949] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.949] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.949] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aad4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.949] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.949] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aad4) returned 0x10ab [0269.950] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="INDEX.001", cAlternateFileName="")) returned 1 [0269.950] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.950] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab90, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.950] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.950] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab90) returned 0x10ab [0269.950] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="INDEX.002", cAlternateFileName="")) returned 1 [0269.951] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.951] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac4c) returned 0x10ab [0269.951] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 1 [0269.951] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.951] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2acf4, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.951] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.951] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2acf4) returned 0x10ab [0269.952] FindNextFileA (in: hFindFile=0x325158, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x18e100, dwReserved1=0x18e11c, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 0 [0269.952] FindClose (in: hFindFile=0x325158 | out: hFindFile=0x325158) returned 1 [0269.952] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 0 [0269.952] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0269.952] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x31c8f0, cFileName="PropMap", cAlternateFileName="")) returned 1 [0269.952] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325118 [0269.953] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.953] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x41, dwReserved1=0x0, cFileName="CiPT0000.000", cAlternateFileName="")) returned 1 [0269.953] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.953] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.953] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.953] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ae38, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.953] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.953] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ae38) returned 0x10ab [0269.953] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="CiPT0000.001", cAlternateFileName="")) returned 1 [0269.954] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.954] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.954] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.954] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aeec, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.954] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.954] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aeec) returned 0x10ab [0269.954] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="CiPT0000.002", cAlternateFileName="")) returned 1 [0269.954] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.954] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.954] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.954] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0269.955] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afa0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.955] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.955] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afa0) returned 0x10ab [0269.955] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0269.955] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="CiPT0000.002", cAlternateFileName="")) returned 0 [0269.955] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0269.955] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300032, dwReserved1=0x31c8f0, cFileName="SecStore", cAlternateFileName="")) returned 1 [0269.955] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName=".", cAlternateFileName="")) returned 0x325118 [0269.955] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="..", cAlternateFileName="")) returned 1 [0269.955] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="CiST0000.000", cAlternateFileName="")) returned 1 [0269.956] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.956] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0269.956] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b03c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.956] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.956] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b03c) returned 0x10ab [0269.956] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0269.957] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="CiST0000.001", cAlternateFileName="")) returned 1 [0269.957] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.957] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.957] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.957] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0269.957] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b03c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.957] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.957] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b03c) returned 0x10ab [0269.957] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0269.958] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="CiST0000.002", cAlternateFileName="")) returned 1 [0269.958] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.958] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.958] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.958] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0269.958] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b03c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.958] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.958] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b03c) returned 0x10ab [0269.959] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0269.959] FindNextFileA (in: hFindFile=0x325118, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18e368, dwReserved1=0x18e384, cFileName="CiST0000.002", cAlternateFileName="")) returned 0 [0269.959] FindClose (in: hFindFile=0x325118 | out: hFindFile=0x325118) returned 1 [0269.959] FindNextFileA (in: hFindFile=0x3250d8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300032, dwReserved1=0x31c8f0, cFileName="SecStore", cAlternateFileName="")) returned 0 [0269.959] FindClose (in: hFindFile=0x3250d8 | out: hFindFile=0x3250d8) returned 1 [0269.959] FindNextFileA (in: hFindFile=0x325098, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9a4, dwReserved1=0x18e9a4, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0269.959] FindClose (in: hFindFile=0x325098 | out: hFindFile=0x325098) returned 1 [0269.959] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Windows.edb", cAlternateFileName="")) returned 1 [0269.959] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.959] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.959] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.959] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a3c0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.959] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.959] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a3c0) returned 0x10ab [0269.960] FindNextFileA (in: hFindFile=0x325058, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x18eaa0, dwReserved1=0x18eabc, cFileName="Windows.edb", cAlternateFileName="")) returned 0 [0269.960] FindClose (in: hFindFile=0x325058 | out: hFindFile=0x325058) returned 1 [0269.960] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0269.960] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.960] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="Temp", cAlternateFileName="")) returned 1 [0269.960] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73726a2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x325018 [0269.960] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73726a2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.960] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73726a2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0269.960] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0269.960] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758ab8b, cFileName="Temp", cAlternateFileName="")) returned 0 [0269.960] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0269.960] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746144, dwReserved1=0x7461642e, cFileName="Data", cAlternateFileName="")) returned 0 [0269.960] FindClose (in: hFindFile=0x324f98 | out: hFindFile=0x324f98) returned 1 [0269.960] FindNextFileA (in: hFindFile=0x324f58, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x536d6174, dwReserved1=0x2e657469, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0269.960] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746173, dwReserved1=0x7461642e, cFileName=".", cAlternateFileName="")) returned 0x324f98 [0269.961] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746173, dwReserved1=0x7461642e, cFileName="..", cAlternateFileName="")) returned 1 [0269.961] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61746173, dwReserved1=0x7461642e, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0269.961] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0269.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0269.961] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a500, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0269.961] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0269.961] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a500) returned 0x10ab [0269.961] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0269.962] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\3570354E72474A6E306A532048414C506D63787A.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\3570354e72474a6e306a532048414c506d63787a.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0269.962] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0269.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0269.963] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0270.083] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\3570354E72474A6E306A532048414C506D63787A.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\3570354e72474a6e306a532048414c506d63787a.dat")) returned 0 [0270.084] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\3570354E72474A6E306A532048414C506D63787A.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\3570354e72474a6e306a532048414c506d63787a.dat")) returned 0x2020 [0270.084] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 0x324fd8 [0270.084] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 0 [0270.084] FindClose (in: hFindFile=0x324fd8 | out: hFindFile=0x324fd8) returned 1 [0270.084] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat")) returned 1 [0270.085] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat")) returned 0xffffffff [0270.085] FindNextFileA (in: hFindFile=0x324f98, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7735387a, dwReserved1=0x7758a963, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0270.085] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x980096, dwReserved1=0x31c7b8, cFileName=".", cAlternateFileName="")) returned 0x324fd8 [0270.086] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x980096, dwReserved1=0x31c7b8, cFileName="..", cAlternateFileName="")) returned 1 [0270.087] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x980096, dwReserved1=0x31c7b8, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1 [0270.087] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0270.087] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.087] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0270.087] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2927c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0270.087] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.087] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2927c) returned 0x10ab [0270.087] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0270.088] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653130.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653130.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0270.089] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0270.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0270.090] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0270.188] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0270.191] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0270.193] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.215] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.225] CloseHandle (hObject=0x100) returned 1 [0270.226] CloseHandle (hObject=0xf0) returned 1 [0270.226] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653130.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653130.bmp")) returned 0 [0270.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653130.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653130.bmp")) returned 0x2020 [0270.226] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 0x325018 [0270.226] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 0 [0270.226] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0270.226] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0 [0270.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0x20 [0270.226] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1 [0270.227] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0270.227] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.227] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0270.227] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a920, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0270.227] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.227] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a920) returned 0x10ab [0270.227] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0270.228] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653131.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653131.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0270.228] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0270.228] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0270.229] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0270.301] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0270.315] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0270.319] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.343] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.357] CloseHandle (hObject=0xf0) returned 1 [0270.357] CloseHandle (hObject=0x100) returned 1 [0270.360] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653131.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653131.bmp")) returned 0 [0270.360] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653131.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653131.bmp")) returned 0x2020 [0270.360] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 0x325018 [0270.361] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 0 [0270.361] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0270.361] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp")) returned 0 [0270.361] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp")) returned 0x20 [0270.361] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1 [0270.364] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0270.364] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.367] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0270.367] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab44, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0270.367] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.367] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab44) returned 0x10ab [0270.367] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0270.367] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653132.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653132.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0270.368] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0270.368] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0270.368] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0270.464] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0270.468] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0270.469] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.491] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.503] CloseHandle (hObject=0x100) returned 1 [0270.503] CloseHandle (hObject=0xf0) returned 1 [0270.503] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653132.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653132.bmp")) returned 0 [0270.503] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653132.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653132.bmp")) returned 0x2020 [0270.503] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 0x325018 [0270.504] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 0 [0270.504] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0270.504] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp")) returned 0 [0270.504] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp")) returned 0x20 [0270.504] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1 [0270.505] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0270.505] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.505] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0270.505] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac74, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0270.505] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.505] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac74) returned 0x10ab [0270.505] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0270.505] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653133.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653133.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0270.506] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbeb8 [0270.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0270.506] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0270.593] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xbeb8, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xbeb8, lpOverlapped=0x0) returned 1 [0270.595] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xbec0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xbec0, lpOverlapped=0x0) returned 1 [0270.597] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.619] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.630] CloseHandle (hObject=0xf0) returned 1 [0270.630] CloseHandle (hObject=0x100) returned 1 [0270.630] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653133.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653133.bmp")) returned 0 [0270.630] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653133.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653133.bmp")) returned 0x2020 [0270.630] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 0x325018 [0270.630] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 0 [0270.630] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0270.630] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp")) returned 0 [0270.630] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp")) returned 0x20 [0270.630] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1 [0270.631] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0270.631] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.631] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0270.631] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2927c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0270.631] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.631] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2927c) returned 0x10ab [0270.631] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0270.632] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653134.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653134.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0270.633] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0270.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0270.633] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0270.720] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0270.723] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0270.724] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.746] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.757] CloseHandle (hObject=0x100) returned 1 [0270.757] CloseHandle (hObject=0xf0) returned 1 [0270.757] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653134.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653134.bmp")) returned 0 [0270.758] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653134.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653134.bmp")) returned 0x2020 [0270.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 0x325018 [0270.758] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 0 [0270.758] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0270.758] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp")) returned 0 [0270.758] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp")) returned 0x20 [0270.758] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1 [0270.759] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0270.759] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.759] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0270.759] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0270.759] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b074, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0270.759] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.759] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b074) returned 0x10ab [0270.759] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0270.760] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0270.760] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653135.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653135.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0270.761] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0270.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0270.761] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0270.833] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0270.836] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0270.837] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.859] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.873] CloseHandle (hObject=0xf0) returned 1 [0270.873] CloseHandle (hObject=0x100) returned 1 [0270.873] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653135.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653135.bmp")) returned 0 [0270.873] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653135.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653135.bmp")) returned 0x2020 [0270.873] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 0x325018 [0270.873] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 0 [0270.873] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0270.873] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp")) returned 0 [0270.873] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp")) returned 0x20 [0270.873] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1 [0270.874] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0270.874] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.874] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0270.874] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a4bc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0270.874] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0270.874] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a4bc) returned 0x10ab [0270.875] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0270.875] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653136.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653136.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0270.875] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0270.875] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0270.876] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0270.964] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0270.967] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0270.968] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.990] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.001] CloseHandle (hObject=0x100) returned 1 [0271.001] CloseHandle (hObject=0xf0) returned 1 [0271.002] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653136.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653136.bmp")) returned 0 [0271.002] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653136.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653136.bmp")) returned 0x2020 [0271.002] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 0x325018 [0271.002] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 0 [0271.002] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0271.002] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp")) returned 0 [0271.002] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp")) returned 0x20 [0271.002] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1 [0271.003] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0271.003] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.003] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0271.003] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a5dc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0271.003] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.003] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a5dc) returned 0x10ab [0271.003] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0271.004] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653137.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653137.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0271.004] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0271.004] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0271.005] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0271.092] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0271.094] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0271.096] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.118] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.138] CloseHandle (hObject=0xf0) returned 1 [0271.138] CloseHandle (hObject=0x100) returned 1 [0271.138] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653137.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653137.bmp")) returned 0 [0271.138] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653137.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653137.bmp")) returned 0x2020 [0271.138] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 0x325018 [0271.138] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 0 [0271.138] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0271.138] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp")) returned 0 [0271.139] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp")) returned 0x20 [0271.139] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1 [0271.140] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0271.140] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.140] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0271.140] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2921c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0271.140] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.140] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2921c) returned 0x10ab [0271.140] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0271.141] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653138.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653138.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0271.142] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0271.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0271.142] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0271.232] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0271.234] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0271.236] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.258] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.269] CloseHandle (hObject=0x100) returned 1 [0271.269] CloseHandle (hObject=0xf0) returned 1 [0271.269] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653138.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653138.bmp")) returned 0 [0271.269] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653138.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653138.bmp")) returned 0x2020 [0271.269] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 0x325018 [0271.269] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 0 [0271.269] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0271.270] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp")) returned 0 [0271.270] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp")) returned 0x20 [0271.270] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1 [0271.271] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0271.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0271.271] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2aa40, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0271.271] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.271] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2aa40) returned 0x10ab [0271.271] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0271.271] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653139.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653139.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0271.272] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0271.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0271.272] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0271.352] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0271.355] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0271.357] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.378] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.411] CloseHandle (hObject=0xf0) returned 1 [0271.411] CloseHandle (hObject=0x100) returned 1 [0271.411] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653139.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653139.bmp")) returned 0 [0271.411] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653139.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653139.bmp")) returned 0x2020 [0271.411] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 0x325018 [0271.411] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 0 [0271.411] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0271.411] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp")) returned 0 [0271.412] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp")) returned 0x20 [0271.412] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1 [0271.413] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0271.413] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.413] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0271.413] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ab4c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0271.413] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.413] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ab4c) returned 0x10ab [0271.413] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0271.413] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653230.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653230.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0271.414] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0271.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0271.414] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0271.485] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0271.488] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0271.489] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.512] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.523] CloseHandle (hObject=0x100) returned 1 [0271.523] CloseHandle (hObject=0xf0) returned 1 [0271.523] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653230.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653230.bmp")) returned 0 [0271.523] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653230.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653230.bmp")) returned 0x2020 [0271.523] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 0x325018 [0271.523] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 0 [0271.523] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0271.523] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp")) returned 0 [0271.523] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp")) returned 0x20 [0271.523] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1 [0271.524] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0271.524] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.524] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0271.524] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c29290, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0271.524] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.524] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c29290) returned 0x10ab [0271.524] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0271.525] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653231.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653231.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0271.525] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0271.525] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0271.526] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0271.611] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0271.633] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0271.635] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.657] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.668] CloseHandle (hObject=0xf0) returned 1 [0271.668] CloseHandle (hObject=0x100) returned 1 [0271.668] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653231.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653231.bmp")) returned 0 [0271.668] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653231.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653231.bmp")) returned 0x2020 [0271.668] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 0x325018 [0271.669] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 0 [0271.669] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0271.669] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp")) returned 0 [0271.669] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp")) returned 0x20 [0271.669] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1 [0271.669] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0271.669] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.669] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0271.670] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0271.670] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2afbc, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0271.670] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.670] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2afbc) returned 0x10ab [0271.670] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0271.670] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0271.671] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653232.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653232.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0271.672] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0271.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0271.672] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0271.757] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0271.759] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0271.761] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.783] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.794] CloseHandle (hObject=0x100) returned 1 [0271.794] CloseHandle (hObject=0xf0) returned 1 [0271.794] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653232.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653232.bmp")) returned 0 [0271.794] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653232.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653232.bmp")) returned 0x2020 [0271.794] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 0x325018 [0271.794] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 0 [0271.794] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0271.794] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp")) returned 0 [0271.794] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp")) returned 0x20 [0271.794] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1 [0271.795] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0271.795] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.795] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0271.795] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0271.796] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0271.796] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.796] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0271.796] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0271.796] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0271.796] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653233.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653233.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0271.797] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0271.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0271.797] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0271.868] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0271.871] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0271.887] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.909] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.921] CloseHandle (hObject=0xf0) returned 1 [0271.921] CloseHandle (hObject=0x100) returned 1 [0271.921] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653233.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653233.bmp")) returned 0 [0271.921] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653233.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653233.bmp")) returned 0x2020 [0271.921] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 0x325018 [0271.921] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 0 [0271.921] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0271.921] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp")) returned 0 [0271.922] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp")) returned 0x20 [0271.922] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1 [0271.922] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0271.922] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.922] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0271.922] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a5d0, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0271.922] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0271.922] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a5d0) returned 0x10ab [0271.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0271.923] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653234.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653234.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0271.923] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0271.923] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0271.924] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0271.993] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0271.996] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0271.998] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.019] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.030] CloseHandle (hObject=0x100) returned 1 [0272.030] CloseHandle (hObject=0xf0) returned 1 [0272.030] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653234.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653234.bmp")) returned 0 [0272.030] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653234.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653234.bmp")) returned 0x2020 [0272.030] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 0x325018 [0272.031] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 0 [0272.031] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0272.031] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp")) returned 0 [0272.031] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp")) returned 0x20 [0272.031] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1 [0272.031] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0272.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0272.031] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a910, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0272.031] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.031] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a910) returned 0x10ab [0272.032] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0272.032] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653235.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653235.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0272.032] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0272.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0272.033] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0272.118] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0272.129] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0272.131] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.154] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.164] CloseHandle (hObject=0xf0) returned 1 [0272.164] CloseHandle (hObject=0x100) returned 1 [0272.165] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653235.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653235.bmp")) returned 0 [0272.165] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653235.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653235.bmp")) returned 0x2020 [0272.165] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 0x325018 [0272.165] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 0 [0272.165] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0272.165] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp")) returned 0 [0272.166] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp")) returned 0x20 [0272.166] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1 [0272.166] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0272.166] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0272.167] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2ac7c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0272.167] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.167] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2ac7c) returned 0x10ab [0272.167] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0272.168] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653236.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653236.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0272.171] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0272.171] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0272.172] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0272.257] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0272.291] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0272.293] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.315] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.326] CloseHandle (hObject=0x100) returned 1 [0272.326] CloseHandle (hObject=0xf0) returned 1 [0272.327] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653236.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653236.bmp")) returned 0 [0272.327] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653236.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653236.bmp")) returned 0x2020 [0272.327] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 0x325018 [0272.327] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 0 [0272.327] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0272.327] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp")) returned 0 [0272.327] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp")) returned 0x20 [0272.327] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1 [0272.328] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0272.328] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.328] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0272.328] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c291f8, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0272.328] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.328] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c291f8) returned 0x10ab [0272.328] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0272.329] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653237.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653237.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0272.329] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0272.329] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0272.329] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0272.434] ReadFile (in: hFile=0xf0, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0272.437] WriteFile (in: hFile=0x100, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0272.438] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.461] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.471] CloseHandle (hObject=0xf0) returned 1 [0272.471] CloseHandle (hObject=0x100) returned 1 [0272.472] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653237.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653237.bmp")) returned 0 [0272.472] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653237.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653237.bmp")) returned 0x2020 [0272.472] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 0x325018 [0272.472] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 0 [0272.472] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0272.472] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp")) returned 0 [0272.472] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp")) returned 0x20 [0272.472] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1 [0272.473] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0272.473] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.473] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0272.473] VirtualAlloc (lpAddress=0x1c2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c2c000 [0272.473] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2b010, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0272.473] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.473] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2b010) returned 0x10ab [0272.474] VirtualFree (lpAddress=0x1c2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0272.474] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0272.474] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653238.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653238.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0272.475] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0272.475] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0272.475] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000 [0272.564] ReadFile (in: hFile=0x100, lpBuffer=0x280000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0272.567] WriteFile (in: hFile=0xf0, lpBuffer=0x280000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x280000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0272.568] VirtualFree (lpAddress=0x2800000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.591] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.601] CloseHandle (hObject=0x100) returned 1 [0272.602] CloseHandle (hObject=0xf0) returned 1 [0272.602] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653238.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653238.bmp")) returned 0 [0272.602] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653238.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653238.bmp")) returned 0x2020 [0272.602] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 0x325018 [0272.602] FindNextFileA (in: hFindFile=0x325018, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x331f48, dwReserved1=0x308ae0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 0 [0272.602] FindClose (in: hFindFile=0x325018 | out: hFindFile=0x325018) returned 1 [0272.602] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp")) returned 0 [0272.603] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp")) returned 0x20 [0272.603] FindNextFileA (in: hFindFile=0x324fd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1 [0272.603] GetWindowTextLengthA (hWnd=0x50018) returned 4267 [0272.603] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.603] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10ab [0272.603] GetWindowTextA (in: hWnd=0x50018, lpString=0x1c2a45c, nMaxCount=4268 | out: lpString=".rar; .zip; .png; .lnk; .ini; .jpg; .rtf; .jpeg; .pdf; .doc; .docx; .txt; .a; .aac; .a3w; .abk; .abr; .ace; .ace; .acr; .act; .ad; .adf; .adm; .adp; .adr; .ai; .aif; .ani; .ans; .ape; .apk; .arc; .arj; .as; .asc; .asf; .asp; .ato; .aty; .au; .avi; .axx; .b3d; .b64; .bak; .bas; .bat; .bfc; .bg; .bin; .bk2; .k2p; .bmp; .bnk; .bps; .bpt; .brk; .btoa; .bv1; .bwp; .bz; .bz2; .c; .cab; .cal; .cam; .cas; .cbl; .cbt; .cda; .cdr; .cdt; .cfb; .cfg; .cfl; .cfm; .cgm; .chk; .cl; .cl3; .cl4; .cla; .clg; .clk; .cll; .clo; .clp; .clr; .cls; .cmd; .cmv; .cnt; .cpl; .cne; .cnf; .cnv; .cob; .cod; .com; .cpe; .cpi; .cpp; .cpt; .cr2; .crw; .crt; .csv; .css; .cue; .cur; .cv5; .cvi; .cvs; .cvx; .cxf; .cxx; .d; .daa; .daf; .dat; .db; .db2; .dbc; .dbf; .dbk; .dbm; .dbo; .dbq; .dbt; .dbv; .dbw; .dbx; .dcm; .dcr; .dcx; .dds; .deb; .dev; .dib; .dif; .djvu; .dll; .dmo; .dmp; .dmd; .dmf; .dms; .dne; .dng; .dos; .dot; .drv; .drw; .dt_; .dta; .dtd; .dtf; .dtm; .dun; .dx; .dxf; .dxn; .dxr; .dyn; .dwf; .dwg; .ecw; .eeb; .eef; .eft; .ega;\r\n.elg; .emf; .eml; .emu; .enc; .end; .eng; .env; .epg; .eps; .eqn; .erd; .erm; .err; .esh; .evt; .ex3; .exc; .exd; .exe; .ext; .fcp; .fdf; .fes; .ff; .ffa; .fff; .ffl; .ffo; .fft; .ffx; .fits; .flac; .flv; .fnd; .fon; .fpb; .fpr; .fpx; .fqy; .fr3; .frc; .frf; .frg; .frk; .frm; .fro; .frp; .frs; .frt; .frx; .frz; .fsc; .fsh; .g3; .gho; .gif; .gr2; .gr3; .gra; .grb; .grf; .grp; .gz; .hbk; .hdl; .hdr; .hdx; .hex; .hfi; .hgl; .hh; .hhh; .hhp; .hlp; .hpgl; .hqx; .hsq; .hss; .hst; .hta; .htm; .html; .htt; .ica; .icb; .icc; .ice; .icl; .icm; .icn; .ico; .ics; .id; .idb; .idd; .ide; .idf; .idq; .idx; .iff; .ifo; .ima; .img; .inf; .ins; .ipd; .ipf; .iso; .iw44; .iwa; .j2k; .jar; .jas; .jef; .jng; .jp2; .jpc; .jpm; .js; .jsb; .jsd; .jse; .jsh; .jsl; .jsm; .jsp; .jss; .json; .jt; .jtf; .jtk; .jtp; .jw; .jwl; .jzz; .kar; .kbc; .kdc; .kdp; .kfx; .kye; .lbm; .ldf; .lgc; .lgo; .lha; .lib; .log; .lnk; .lwf; .lwp; .lzh; .mac; .mbx; .mcd; .md; .mda; .mdb; .mde; .mdf; .mdl; .mdm; .mdn; .mdp; .mdt; .mdw; .mdx; .mdz; .meb; .med;\r\n.mem; .mht; .mid; .mim; .mix; .mk3d; .mka; .mks; .mkv; .mme; .mng; .mod; .mov; .mp1; .mp2; .mp3; .mpp; .mpg; .mrw; .msc; .msi; .msn; .msp; .mtf; .mtm; .mtv; .mtw; .mu; .mul; .mup; .mus; .mvb; .mve; .mvf; .mwp; .mxd; .mxt; .myd; .n64; .na2; .nab; .nap; .ndf; .nds; .ndx; .nef; .nes; .neta; .nfo; .nil; .ngf; .ngg; .nhf; .nlb; .nld; .nlm; .nmi; .nol; .now; .nra; .nrb; .ngr; .ns2; .ns5; .nso; .nt; .num; .nzb; .oca; .ocx; .ogg; .ogm; .olb; .old; .ole; .oli; .orf; .ori; .qtif; .otl; .pab; .pak; .pb; .pbd; .pbf; .pbk; .pbl; .pbm; .pbr; .pbi; .pbo; .pbt; .pcd; .pcx; .pda; .pdb; .pdd; .pdl; .pds; .pdv; .pdw; .pef; .pf; .pgm; .php; .pic; .pict; .pif; .pjf; .pkg; .pl; .plb; .plc; .pld; .plg; .pli; .pll; .plm; .pln; .plr; .pls; .plt; .ply; .pot; .pp; .pp4; .pp5; .ppa; .ppb; .ppd; .ppf; .ppi; .ppl; .ppm; .ppo; .pps; .ppt; .ppz; .ps2; .psd; .psp; .pst; .pwa; .pwd; .pwf; .pwl; .pwp; .pwz; .px; .pxl; .py; .pyc; .pyd; .pyw; .pza; .pzd; .pzl; .pzo; .pzp; .pzs; .pzt; .pzx; .qic; .qt; .qxd; .qxl; .qxt; .ra; .raf; .ram; .ras;\r\n.rc; .rd1; .rd3; .rd4; .rd5; .rdb; .rdl; .rdx; .rec; .rgb; .rle; .rmi; .rpb; .rpd; .rpm; .rpt; .rwz; .sav; .sc2; .scp; .scr; .sct; .sd; .sd2; .sda; .sdc; .sdd; .sdf; .sdk; .sdl; .sdn; .sdr; .sds; .sdt; .sdw; .sdx; .se; .sea; .sff; .sfw; .sgi; .sh; .sh3; .shb; .shg; .shk; .shm; .shp; .shr; .shw; .sid; .sit; .sitx; .slk; .smil; .snd; .sng; .snm; .sno; .snp; .spd; .srf; .sum; .sun; .svg; .swf; .swp; .sxc; .sys; .tar; .tar.gz; .tbz; .tbz2; .tdf; .tga; .tgz; .tif; .tlb; .tld; .tle; .tlp; .tlt; .tlx; .tmp; .topc; .trm; .trs; .uni; .unk; .unx; .url; .uu; .uue; .vb; .vba; .vbd; .vbe; .vbg; .vbk; .vbl; .vbp; .vbr; .vbs; .vbw; .vbx; .vbz; .vc; .vcd; .vce; .vcf; .vcs; .vct; .vcw; .vcx; .vda; .vdd; .vdo; .vls; .vm; .vmm; .vmf; .vmh; .vob; .vs2; .vsd; .vsl; .vss; .vst; .vsw; .vxd; .wab; .wad; .wal; .wav; .wb1; .wb2; .wbf; .wbk; .wbmp; .wbt; .wcd; .wcm; .wcp; .wdb; .web; .wfm; .wfn; .wfx; .wg1; .wg2; .wid; .win; .wiz; .wk1; .wk3; .wlg; .wma; .wmf; .wmv; .wmz; .wpd; .wpg; .wpm; .wps; .wri; .wrk; .wsc; .wsf; .x3f; .xap;\r\n.xbm; .xif; .xlb; .xlr; .xls; .xm; .xml; .xnk; .xot; .xpm; .xqt; .xrf; .xr1; .xsl; .xsm; .xtb; .xwd; .xwf; .xxe; .xy; .xy3; .xy4; .xyp; .xyw; .y; .y01; .yaml; .yuv; .yz; .z; .zoo;") returned 4267 [0272.603] GetPropA (hWnd=0x50018, lpString="SELF_") returned 0x1c22b68 [0272.603] CallWindowProcA (lpPrevWndFunc=0x7739abb2, hWnd=0x50018, Msg=0xd, wParam=0x10ac, lParam=0x1c2a45c) returned 0x10ab [0272.603] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0272.604] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\7573657274696C653239.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\7573657274696c653239.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0272.611] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0272.611] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2800000 [0272.611] VirtualAlloc (lpAddress=0x2800000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000